Sub-processors
Effective 3 September 2026 · Version 1.1
This page lists the sub-processors that Baby Elephant B.V., trading as Aitonomy (“Aitonomy”), engages to process Customer Data and Customer Materials in connection with the Aitonomy platform and Aitonomy’s services (together the “Services”). These third parties are sub-processors within the meaning of the GDPR. Words written with a capital that are not defined here have the meaning given in the SaaS Terms and Conditions, the Services Terms and Conditions and the Data Processing Agreement.
This list covers sub-processors that process Customer Data or Customer Materials in connection with the Services. The processing of the personal data of visitors to our website is described in our Privacy Statement.
How models are selected
Aitonomy is model independent. A model is selected for each task and recorded for each agent, weighed on capability, cost and the jurisdictional requirements of the Customer’s organisation. There is no single default model and no single model provider. Processing and inference take place within the European Economic Area.
Data residency and sovereignty are not the same thing, and we set them out separately because the difference decides which providers a Customer can accept:
Data residency. Where the data is physically processed and stored. All processing under the Services takes place within the European Economic Area.
Sovereignty. Which jurisdiction the provider itself is subject to. A provider based outside the European Economic Area remains subject to the law of its own jurisdiction even where it processes exclusively within the European Economic Area.
Two configurations follow from that, and the Customer chooses between them:
A fully European chain. Both processing and inference with providers established in the European Economic Area. This is available where the Customer requires it, and it is the configuration we apply where the Customer is a critical entity or is otherwise subject to a hard jurisdictional requirement.
A frontier model from outside the European Economic Area, served from European infrastructure. This is resident within the European Economic Area but the provider is not subject to European jurisdiction alone. That is an explicit choice, recorded for each agent, and it is never applied as a default. Where the Customer does not make that choice, this configuration is not used.
Providers marked Optional below are engaged only for a Customer whose configuration uses them, and only for that Customer.
Current sub-processors
| Sub-processor | Purpose | Location | Jurisdiction and transfer basis |
|---|---|---|---|
| Scaleway SAS | Cloud hosting: hosting, storage and processing of Customer Data and Customer Materials for the Services. Also AI model serving, where the Customer’s configuration uses a model served by Scaleway. | France (Paris); Netherlands (Amsterdam) | France, European Union. Within EEA |
| Amazon Web Services EMEA SARL, Bedrock<br>Optional | AI model provider. Processing of prompts and related inputs submitted to Agents in an EU region, where the Customer opts to use a model served on AWS Bedrock. Used only on the Customer’s explicit choice under the second configuration above. | EU region (EEA), region-restricted | Luxembourg entity within a group subject to United States law. Within EEA, with standard contractual clauses for any access by the provider’s non-EEA group. Resident in the EEA but not subject to European jurisdiction alone |
Updates
As our business develops, our sub-processors may change. Where a change is relevant, we will update this list and give notice to our customers as required under the Data Processing Agreement. A customer may object to an intended change on reasonable data protection grounds within five (5) Business Days of the notice, as set out in the Data Processing Agreement.
Baby Elephant B.V., trading as Aitonomy · Emmastraat 23, 2282 AM Rijswijk, The Netherlands · KvK 27299029
Version 1.1 · 3 September 2026