Subprocessors
Last updated: September 30, 2026
This list is part of the data processing agreement (DPA) signed with each client. Ragnight tells the client's administrators by e-mail at least thirty days before adding or replacing a subprocessor; the client may object under the terms of the DPA. Questions: privacy@ragnight.com.
Sovereign mode. When the client turns it on, all processing by AI models goes directly to Mistral AI, in France: only the subprocessors marked “Receives data” are then involved.
Standard operation
| Subprocessor | Role | Location | Data transferred | Transfer basis | Sovereign mode |
|---|---|---|---|---|---|
| Scaleway SAS | Server and database hosting, file storage, backups, e-mail delivery | France (Paris region) | All client data | Not applicable (European Union) | Receives data |
| OpenRouter, Inc. | Router to the AI models: answers, agents, indexing, reading of scanned documents, transcription | United States | Questions, retrieved passages, text to index, images of scanned documents, meeting audio | Standard contractual clauses (module 2), through OpenRouter's data processing agreement; content is not retained by default | No data |
| Anthropic, PBC | Default model for answers and agents (Claude), through OpenRouter | United States | Questions and retrieved passages | Standard contractual clauses, through OpenRouter's data processing agreement | No data |
| OpenAI | Indexing and reading of scanned documents, through OpenRouter; some Knowledge Pulse analyses directly | United States | Document text, images of scanned documents | Standard contractual clauses: through OpenRouter's data processing agreement or, for direct calls, OpenAI's (OpenAI Ireland Ltd) | No data |
| Google LLC | Light model (Gemini), through OpenRouter: support assistant, public widget, question rewriting, Knowledge Pulse objective descriptions; image generation if the client turns it on | United States | Questions asked to support or the widget, objective names; image prompts and images to edit | Data Privacy Framework (certification active until 13 September 2027) | No data |
| Mistral AI SAS | Meeting transcription (Voxtral); optionally, voice-based speaker attribution and the European index; in sovereign mode, all processing by AI models, directly | France | Meeting audio; document text if the European index is chosen; in sovereign mode, all data sent to AI models | Not applicable (European Union) for direct calls, including all of sovereign mode; through OpenRouter: standard contractual clauses, through OpenRouter's data processing agreement | Receives data |
| Jina AI GmbH | Ranking of search results | Germany | Question and candidate passages | Not applicable (European Union) | Receives data |
| Functional Software, Inc. (Sentry) | Technical error tracking | US company, data hosted in the European Union (Germany) | Error messages and technical context: user identifier and IP address; cookies, request bodies and secrets redacted before sending | Data Privacy Framework (certification active until 28 May 2027); standard contractual clauses otherwise | Receives data |
Scaleway SAS
- Role
- Server and database hosting, file storage, backups, e-mail delivery
- Location
- France (Paris region)
- Data transferred
- All client data
- Transfer basis
- Not applicable (European Union)
- Sovereign mode
- Receives data
OpenRouter, Inc.
- Role
- Router to the AI models: answers, agents, indexing, reading of scanned documents, transcription
- Location
- United States
- Data transferred
- Questions, retrieved passages, text to index, images of scanned documents, meeting audio
- Transfer basis
- Standard contractual clauses (module 2), through OpenRouter's data processing agreement; content is not retained by default
- Sovereign mode
- No data
Anthropic, PBC
- Role
- Default model for answers and agents (Claude), through OpenRouter
- Location
- United States
- Data transferred
- Questions and retrieved passages
- Transfer basis
- Standard contractual clauses, through OpenRouter's data processing agreement
- Sovereign mode
- No data
OpenAI
- Role
- Indexing and reading of scanned documents, through OpenRouter; some Knowledge Pulse analyses directly
- Location
- United States
- Data transferred
- Document text, images of scanned documents
- Transfer basis
- Standard contractual clauses: through OpenRouter's data processing agreement or, for direct calls, OpenAI's (OpenAI Ireland Ltd)
- Sovereign mode
- No data
Google LLC
- Role
- Light model (Gemini), through OpenRouter: support assistant, public widget, question rewriting, Knowledge Pulse objective descriptions; image generation if the client turns it on
- Location
- United States
- Data transferred
- Questions asked to support or the widget, objective names; image prompts and images to edit
- Transfer basis
- Data Privacy Framework (certification active until 13 September 2027)
- Sovereign mode
- No data
Mistral AI SAS
- Role
- Meeting transcription (Voxtral); optionally, voice-based speaker attribution and the European index; in sovereign mode, all processing by AI models, directly
- Location
- France
- Data transferred
- Meeting audio; document text if the European index is chosen; in sovereign mode, all data sent to AI models
- Transfer basis
- Not applicable (European Union) for direct calls, including all of sovereign mode; through OpenRouter: standard contractual clauses, through OpenRouter's data processing agreement
- Sovereign mode
- Receives data
Jina AI GmbH
- Role
- Ranking of search results
- Location
- Germany
- Data transferred
- Question and candidate passages
- Transfer basis
- Not applicable (European Union)
- Sovereign mode
- Receives data
Functional Software, Inc. (Sentry)
- Role
- Technical error tracking
- Location
- US company, data hosted in the European Union (Germany)
- Data transferred
- Error messages and technical context: user identifier and IP address; cookies, request bodies and secrets redacted before sending
- Transfer basis
- Data Privacy Framework (certification active until 28 May 2027); standard contractual clauses otherwise
- Sovereign mode
- Receives data
Only if the client turns the function on
| Subprocessor | Role | Location | Data transferred | Transfer basis | Sovereign mode |
|---|---|---|---|---|---|
| Perplexity AI, Inc. | Web search, through OpenRouter | United States | Web search questions | Data Privacy Framework (certification active; renewal due 8 October 2026) | No data |
| Apollo.io (Zenleads Inc.) | Agent action “Enrich a contact”, after human approval | United States | Name and company of the person looked up | Data Privacy Framework (certification active until 17 March 2027) | Receives data |
Perplexity AI, Inc.
- Role
- Web search, through OpenRouter
- Location
- United States
- Data transferred
- Web search questions
- Transfer basis
- Data Privacy Framework (certification active; renewal due 8 October 2026)
- Sovereign mode
- No data
Apollo.io (Zenleads Inc.)
- Role
- Agent action “Enrich a contact”, after human approval
- Location
- United States
- Data transferred
- Name and company of the person looked up
- Transfer basis
- Data Privacy Framework (certification active until 17 March 2027)
- Sovereign mode
- Receives data
AI model chosen by the client
Outside sovereign mode, the client may pick another model than the default one. Only the publishers on this list can be called: Anthropic, OpenAI, Google, and Mistral AI. Any other model is refused, even when explicitly requested.
Models not offered
- DeepSeek: Depending on the host OpenRouter picks, data may be processed in China, with no adequacy decision.
- xAI (Grok): xAI's data processing agreement requires its zero-retention API, which the OpenRouter route does not guarantee.
- Meta (Llama): Served by third-party hosts, none of them certified under the Data Privacy Framework.
Not on this list
- The publishers of the sources the client connects (Google, Microsoft, Notion, Slack, etc.): they are the client's own providers, which it chooses and authorizes.
- Browser notification relays (Apple, Google, Mozilla): content reaches them end-to-end encrypted, they cannot read it.
- The tools Ragnight uses on its own account (team alerts, advertising), covered by the privacy policy.
Change history
- September 30, 2026: List published. DeepSeek, xAI and Meta (Llama) are no longer offered.
