Skip to main content
By the end of this page you will know how gavAI uses subprocessors, how change-notice works, what is in-region versus out-of-region for your workspace, and how to obtain the current subprocessor inventory.

​
How we describe processors

gavAI describes its platform by architectural role, not by the third-party processor that fills it today. Roles are stable contracts — object storage, primary database, transactional email gateway, AI gateway. The processor that fills each role is an implementation choice that may change. We hold the live inventory off the public docs site for two reasons:

​
Getting the live inventory

Workspace owners and their compliance teams can request the current subprocessor inventory at any time. The inventory includes every architectural role, the current processor for each, the categories of data each one touches, regional residency, and any sub-sub-processor relationships disclosed by the vendor. To request it:

​
Change-notice policy

When we add a new subprocessor or replace an existing one: To subscribe to change-notice emails, contact security@gavai.io with subject subscribe subprocessor-notice and the workspace slug.

​
Data residency

When a workspace is provisioned, the workspace owner selects a region. All processors that handle workspace content or end-user data are configured to keep that workspace in-region. The narrow exceptions — operational telemetry and CRM-related processing — are documented in the live inventory. No workspace content or end-user PII is included in those flows; they carry operator (workspace-owner) account metadata only. If your compliance posture requires strict in-region telemetry, contact us before provisioning so we can confirm we can meet that bar for your account.

​
What subprocessors never touch

Two commitments hold across every processor we use: The architecture is also built to enforce these where possible: workspace content is encrypted at rest with envelope encryption, network egress is audited, and any new data flow requires a documented data-flow review before it ships.