Sub-processors & DPAs
We use a small set of trusted sub-processors to run Vanquish AI. Each is engaged under a data-processing agreement (DPA) with appropriate safeguards. We do not sell personal data.
Current sub-processors
| Provider | Service | Data processed | Region | Transfer safeguard | DPA |
|---|---|---|---|---|---|
| EU cloud hosting provider | Cloud hosting & bot execution | All platform data at rest/in transit | EU/EEA | N/A (EEA) | DPA in place |
| Mollie | Payment processing | Billing & payment reference (no full card data held by us) | EU (Netherlands) | N/A (EEA) | DPA / processor terms |
| Email provider (Resend / SendGrid / Postmark) | Transactional email, verification & alerts | Email address, message content | EU/US | SCCs if US | DPA in place |
| Anthropic | AI market summaries (Claude) | Aggregated market data to generate summaries — no personal data sent | US | EU SCCs + measures | DPA / commercial terms |
| Telegram | Optional notifications (user opt-in) | Telegram chat ID, alert content | Per Telegram | User-enabled; minimised | Per provider terms |
| Brokers — Alpaca, Coinbase, Revolut X | Order execution & account (user-connected) | Orders/instructions and account identifiers | US / EU | User-authorised; SCCs where applicable | Per broker agreement |
| Analytics provider (if enabled) | Privacy-respecting analytics (consent) | Pseudonymous usage data | EU | — | DPA in place |
Brokers you connect act on your authorisation to execute your instructions; your relationship with your broker is governed by the broker's own agreements. Where a provider is outside the EEA, we rely on the EU Standard Contractual Clauses and supplementary measures as appropriate.
Changes
We may add or replace sub-processors. Where required by our DPAs, we will provide advance notice so customers can object. Material changes are reflected here with an updated date.