Legal & trust
Sub-processors
Effective 2026-10-13 · version 1.1
Thalius AI AB (organisation number 559528-5635, VAT SE559528563501, Stockholm, Sweden) uses the following sub-processors to process customer documents and questions in the Thalius Hippocampus cloud service. They are listed by processing stage. This list is Annex 2 of the data processing agreement.
| Stage | Sub-processor | Region | What is processed |
|---|---|---|---|
| Cloud platform, document storage, core processing | Google Cloud | EU (Finland, europe-north1) | Encrypted documents (per-document keys, tenant-bound, wrapped in Cloud KMS); the knowledge structure; usage records |
| Identity | Google Cloud Identity Platform | EU | Account email, sign-in events |
| Text extraction (OCR) | Mistral AI | EU | Page images and extracted text of uploaded documents, transiently |
| Document structure and figure classification | OpenAI | US | Document text fragments, transiently |
| Summaries, embeddings and result selection | Google (Gemini) | US by default; EU-hosted endpoint on request | Document text fragments, transiently |
| Answer generation | OpenAI, Google or Anthropic, as configured per workspace | US by default | Retrieved fragments and the question, transiently |
| Search index | Hosted Typesense cluster | EU | Indexed text and embeddings, per tenant |
| Application and API edge, conversation logs | Cloudflare | Global edge; EU jurisdiction pinning for logs is a near-term item | Requests; question and answer logs attributed to the signed-in user |
Sovereignty option: for customers who require it, every component including model inference can run EU-hosted or in the customer's own environment; this is a deployment configuration available on Corporate.
None of these providers may use customer data to train models. Each one is bound by data protection terms equivalent to the DPA. Transfers to the United States rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses.
Changes to this list are announced on this page with a new effective date, and by email to tenant administrators, at least 30 days before they apply. Administrators may object as set out in the DPA.
Providers that process data about site visitors or billing (analytics, email delivery, payment) and not customer documents are listed in the privacy notice.
Questions: privacy@thalius.ai