Sub-processors

What changed in version 1.17 (2026-10-19). No sub-processor is added, removed or replaced. From version 1.30 of the AI Employees Notice, an AI employee on a client project that a person opened to AI work can read the client's conversation with the team in TimerOS chat and draft a message in it, and an AI employee hired as a support engineer in Vezoft's own workspace can read the support tickets of Vezoft's customers and draft a reply; a person sends every one. The rows and notes for OpenRouter, Anthropic and the inference providers now also list the messages of a client's conversation (with the name of whoever wrote each) and the text of a customer-support ticket (never the customer's e-mail address) that a Customer's, or Vezoft's, AI employee reads, and the drafts it writes. A ticket that TimerOS recognises as about a job applicant, pay, a contract or a personal-data request never reaches them this way.

What changed in version 1.16 (2026-10-16). No sub-processor is added, removed or replaced. From version 1.29 of the AI Employees Notice, an AI employee that a Customer gave a mailbox reads the whole mail, not only a summary: the rows and notes for OpenRouter, Anthropic and the inference providers now also list the whole of a mail (sender, recipients, subject, text, attachment list and the text of plain-text attachments) that a Customer's AI employee reads from a mailbox a person gave it, and the reply it drafts. The Hetzner row says that the AI employee's computer keeps what it read of a mail in the record of its work sessions for 30 days after that session's last activity. The Zoho row says that replies to mail received at Vezoft's own addresses, which Vezoft's AI employees draft and a person at Vezoft sends, are sent and kept in Sent there. The OpenRouter and Anthropic rows also say that, from version 1.29 of the AI Employees Notice, the summary is made from the whole subject and text of a mail, with the text of plain-text attachments, instead of their first 300 and 8,000 characters. A Customer's own mail provider, which also sends the Customer's replies, remains the Customer's choice and is not a Vezoft sub-processor.

What changed in version 1.15 (2026-10-16). No sub-processor is added, removed or replaced. The rows for OpenRouter, Anthropic and Hetzner now also list the mail that a Customer's AI employees read as summaries. From version 1.26 of the AI Employees Notice, a Customer may give an AI employee a mailbox. Vezoft's fleet service then sends the first 300 characters of a mail's subject, the first 8,000 of its text and the sender's domain through OpenRouter to Anthropic, which writes a short summary on the same pinned, zero-retention route. The Zoho row now names sales@ among Vezoft's own mailboxes. A Customer's own mail provider, which it connects in Settings → Mailboxes, is engaged by the Customer and is not a Vezoft sub-processor.

What changed in version 1.14 (2026-10-16). No sub-processor is added, removed or replaced. The row and the notes on Hetzner now say how an AI employee's computer reaches the internet since version 1.24 of the AI Employees Notice: it has no public address of its own and sits in a private network that Vezoft runs at Hetzner for that Customer only, and its connections pass through one gateway machine there, which lets them through only to the hosts on its list, by name, answers its name lookups only for those hosts, and records, for each day, the names it connected to and those it was refused (kept for 90 days). The per-machine cloud firewalls are gone. See the AI Employees Notice, version 1.24.

What changed in version 1.13 (2026-10-11). No sub-processor is added, removed or replaced. The note that GitHub is not a sub-processor now says what the TimerOS GitHub App does in the Customer's account since version 1.16 of the AI Employees Notice: it pushes after a specific push is approved — by a person, by an AI Executive above the AI employee, or under a person's standing permission — and merges a pull request only on an approved merge request, through Vezoft's fleet service. See the AI Employees Notice, version 1.16.

What changed in version 1.12 (2026-10-10). No sub-processor is added, removed or replaced. The row and the notes on Hetzner now say what else an AI employee's computer holds since the AI Employees Notice, version 1.14: its memory file, the skills it writes for itself, and a database with the full record of its work sessions, which it can search and which keeps each session for 30 days after its last activity. That record is not copied to TimerOS and is not carried to a new machine when the AI employee moves, but it is in the snapshots of the machine's whole disk, and it is deleted with the machine. The rows for OpenRouter and Anthropic now also list what version 1.14 of the Notice newly sends to the model providers: the workspace's organisation in every session, the AI employee's own skills, its summaries of long conversations, and earlier session content sent again by its self-review and its searches of its past sessions. The notes also say how the AI employee's own model key, new in version 1.14 of the Notice, is held: by a service on its computer, never written to its disk. The role that was called "team coordinator" is now called "team lead", and the row and the notes on Anthropic now also name the AI Executive, a role new in version 1.14 of the Notice, among the AI employees that can search the web. See the AI Employees Notice, version 1.14.

What changed in version 1.11 (2026-10-07). No sub-processor is added, removed or replaced. An AI employee's image requests no longer go straight from its computer to fal.ai: they go through Vezoft's fleet service, at Hetzner in the EU, which adds Vezoft's key, passes each request to fal.ai and returns the image, keeping neither the prompt nor the image; fal.ai now sees the fleet service's network address instead of the computer's. The rows for OpenRouter, fal.ai and Hetzner and the notes on OpenRouter and fal.ai now say so. The notes on Hetzner also correct how we described the firewall of an AI employee's computer: it blocks direct connections to network addresses that are not on its list, but it does not confine the computer to the sites on that list, because many sites share the same addresses. The rows for OpenRouter and Anthropic also list two kinds of content an AI employee sends to the model providers that they did not list before: a project's whiteboard, including what the Customer's clients added, and the work details of the workspace's current staff, which an AI employee has been able to look up since the first release. See the AI Employees Notice, version 1.13.

What changed in version 1.10 (2026-10-04). No sub-processor is added, removed or replaced. The row and the notes on Hetzner now cover how an AI employee's computer is kept up to date. Vezoft updates its software between work sessions, signed by Vezoft. When its computer image changes, the AI employee moves to a fresh virtual machine, and for that move Hetzner also holds a snapshot of the old machine's whole disk, kept for 7 days and then deleted, and a short-lived helper machine with no public network address, which copies the AI employee's work folder to Vezoft's fleet service (also at Hetzner, in the EU); there the copy is kept encrypted until the move ends, and then deleted. Nothing leaves the EU. See the AI Employees Notice, version 1.11.

What changed in version 1.9 (2026-10-04). Brave Software, Inc. is removed. It was added in version 1.8 for web search by AI employees, but web search was never switched on through it, so nothing was ever sent to it. Web search now runs through Anthropic, already listed below: Vezoft's fleet service sends the text of a search query — under Vezoft's own Anthropic account, and with nothing else about the AI employee, the Customer or any person — to Anthropic's web search tool. Anthropic runs the search with its own search sub-processors, which its published sub-processor list names as Brave Search and TurboPuffer (both United States), and a small Anthropic model (Claude Haiku) writes one line on each result. For Vezoft's own Anthropic account, the contracting party under Anthropic's Commercial Terms is Anthropic Ireland, Limited, and Anthropic's Data Processing Addendum, with Standard Contractual Clauses (Modules 2 and 3), covers the queries and their results. These calls do not go through the OpenRouter gateway, so its zero-retention routing does not cover them; Anthropic's standard retention applies (see “Notes on Anthropic”). No sub-processor is added — Anthropic was already authorised — so no notice period has to run; at this date the Service also has no Customer other than Vezoft itself. See the AI Employees Notice, version 1.10.

What changed in version 1.8 (2026-10-03). Brave Software, Inc. (United States) is added as a sub-processor, for web search by AI employees hired as content writers, SEO specialists or team coordinators. Vezoft's fleet service sends Brave the text of a search query, under Vezoft's own account and with nothing else about the AI employee, the Customer or any person, and receives titles, addresses and short snippets. Brave states that it keeps a record of the queries made with an account for at most 90 days, for billing and troubleshooting, and that it collects no identifier linking a query to an individual or a device. Brave also states that its Data Processing Addendum does not cover search queries, so Vezoft claims no Standard Contractual Clauses for them, and will not switch web search on until Brave is bound, for query data, by written data-protection terms that meet Section 6(d) of the DPA — Standard Contractual Clauses or Brave's certification under the EU-US Data Privacy Framework included (see “Notes on Brave”). Brave is engaged only from the day Vezoft switches web search on; until then nothing is sent to it. No notice period has to run first, because at this date the Service has no Customer other than Vezoft itself, and therefore no one who could be given notice or could object; the 30-day notice commitment below applies in full to every sub-processor added or replaced after this date. The rows for OpenRouter and Anthropic now also list the new prompt content an AI employee may read. No other sub-processor is added, removed or replaced. See the AI Employees Notice, version 1.9.

What changed in version 1.7 (2026-10-03). No sub-processor is added, removed or replaced. The notes on Hetzner now cover two things an AI employee can newly do: read public web pages as plain text through a logged fetch proxy on Vezoft's fleet service, and read — and, after a person approves a specific push, push one branch to — the repositories a person linked to its projects, with a short-lived repository key that, on the machine, only its own service holds. GitHub is not a sub-processor: it is the Customer's own code host, engaged and configured by the Customer; a new paragraph below says why. See the AI Employees Notice, version 1.8.

What changed in version 1.6 (2026-10-02). No sub-processor is added, removed or replaced. fal.ai, listed since version 1.1, is now used for AI employees hired as graphic designers. Their image requests go directly from the AI employee's computer to fal.ai rather than through the OpenRouter gateway, so the gateway's zero-retention routing does not apply to them; fal.ai's own data-processing terms do. The OpenRouter row now says it carries every language-model call, not every model call.

What changed in version 1.5 (2026-10-01). No sub-processor is added, removed or replaced. The rows for OpenRouter, Inc. and Anthropic PBC — and, through them, the allow-listed inference providers — now also list what an AI team lead reads when its workspace has turned on scouting for work: the names and short descriptions of the Customer's projects open to AI work, and the shortened titles and descriptions of their tasks that nobody holds yet, including the names of staff and clients those mention. That is text from projects the AI employee is not assigned to. It is prompt content like everything else an AI employee reads, processed in the United States under the same safeguards. Scouting is off until the Customer turns it on in its workspace settings, so until then nothing new is sent (see the AI Employees Notice, Section 5). The notes on Anthropic also now say that an AI team lead has the access of a team lead over its AI team.

What changed in version 1.4 (2026-10-01). The Cloudflare, Inc. row now also covers website previews. When an AI employee builds a website for a task, it can deploy the build as a preview, hosted on Cloudflare Pages under Vezoft's own Cloudflare account. A preview contains whatever the AI employee built, which may include Customer Personal Data, and Cloudflare also processes the IP address and request metadata of anyone who opens it. Each preview is public: anyone who has or finds its address can open it, and it is not indexed by search engines. Pages cannot be pinned to the EU, so previews are held and served on Cloudflare's global network: next to model inference, they are the second exception to EU processing in the notes on data location below. Each preview is deleted automatically 30 days after it is made, and immediately when its AI employee is offboarded or its workspace is deleted (see “Notes on Cloudflare”). No notice period had to run before this change took effect, because at that date the Service had no Customers and therefore no one who could be given notice or could object; the 30-day notice commitment below applies in full to every sub-processor added or changed from that date onward.

What changed in version 1.3 (2026-09-16). The providers that actually run the models are named, and they are all in the United States. Alibaba Cloud and Z.AI are removed as sub-processors of the inference step. An endpoint audit on 2026-09-16 found that two of the models in the line-up had exactly one serving endpoint each — the vendor's own — so those models were dropped, and the models that remain are served on US infrastructure rather than by their vendors. OpenRouter, Inc. stays the active routing gateway for every tier. The providers it may route an AI employee's request to are now listed by name: Fireworks AI, Together AI, DeepInfra, Parasail and CoreWeave (all United States) for the open-weight models, and Anthropic PBC (United States) for the Claude models. Vezoft pins that allow-list on every request, switches off fallback to anyone outside it, and admits no provider that retains inputs or trains on them (data_collection: deny, zero-retention routing). Two of the models are open-weight models of Chinese origin — GLM and Qwen — run on US infrastructure: that is a fact about which software is executed, not about where the data goes. What has not changed: self-serve EU-region routing is still not available to us through the gateway, so model inference takes place in the United States under the transfer safeguards described here — and the AI employee's own computer, its screen recordings and every TimerOS record stay in the EU. The 30-day notice and objection procedure below applies to this allow-list in full.

What changed in version 1.2 (2026-09-16). Model inference for AI employees now runs through OpenRouter, Inc. as the routing gateway for every tier. OpenRouter therefore moves from a reserved, unused entry to an active sub-processor, engaged from 2026-09-16. Anthropic PBC remains a sub-processor but is now reached through OpenRouter, and only for the top (frontier) tier. Two further model providers are added, because the gateway routes to them for the other tiers: Alibaba Cloud (the Qwen models) and Z.AI (the GLM models). OpenRouter routes each request to one of several upstream providers; Vezoft pins the allow-list on every request, refuses any provider that retains inputs or trains on them, disables silent fallback to a provider outside that list, and pins the numeric precision the model is served at. This page now states plainly that no self-serve EU-region routing is available through the gateway, so model inference may take place outside the EU under the transfer safeguards described here. Nothing else changed: the AI employee's own computer, its screen recordings and every TimerOS record stay in the EU.

What changed in version 1.1 (2026-09-13). Four sub-processors added for the AI-employees feature (Terms Section 2B): Anthropic PBC (AI model inference, United States), OpenRouter, Inc. (model-routing gateway held in reserve for a possible future open-weight Junior tier, United States — not used unless and until such a tier launches), fal.ai (image generation, United States) and Hetzner Online GmbH (the AI employee's virtual computer, Germany). All four are engaged from 2026-09-15. No notice period had to run before they were engaged, because at that date the Service had no Customers and therefore no one who could be given notice or could object; the 30-day notice commitment below applies in full to every sub-processor added or replaced from that date onward. The "Notes on Cloudflare" section also now covers AI-employee screen recordings.

This page lists the third parties that Vezoft EOOD — a single-member limited liability company incorporated in Bulgaria, trading as "Vezoft" / "TimerOS" ("we", "us") — engages to process personal data on behalf of its Customers ("sub-processors"). See the Imprint for our full company details. It is incorporated by reference into the Data Processing Agreement.

We will give Customers at least 30 days' prior notice by email to the account owner address on file before adding or replacing a sub-processor, and Customers may object in writing on reasonable grounds within that 30-day window. To receive notifications, ensure your account owner email is current, or email [email protected] to be added to the sub-processor change notification list.

Current sub-processors

Notes on data location and international transfers

• Storage and the core stack stay in the EU. All Customer Personal Data is stored in the EU and processed there by the systems that run the Service: the databases (MongoDB Atlas, Frankfurt/Ireland), uploaded files and AI-employee screen recordings (Cloudflare R2, EU jurisdiction), application compute (Render, Frankfurt), the AI employees' virtual computers (Hetzner, Germany/Finland), inbound support email (Zoho EU), and outbound system email (Lettermint, EU — Netherlands/France). There are three exceptions, all for AI employees: model inference, the website previews they deploy and the web searches some of them make — see the third bullet. In addition, requests pass through Cloudflare's global CDN edge on their way to the Service (see the next bullet), and Google delivers push notifications for the Android companion app (see the third bullet).
• US-incorporated vendors, EU processing. Several sub-processors (MongoDB, Render, Cloudflare) are US-incorporated companies that nonetheless process the relevant data in the EU (for Cloudflare, the data it stores in R2; its CDN edge and the AI-employee previews are global — see “Notes on Cloudflare”). Because a US parent could in principle be compelled to access data (for example, under the US CLOUD Act), the EU-US Data Privacy Framework and Standard Contractual Clauses in each provider's DPA apply as a safeguard.
• Four channels involve processing outside the EU: Google (Play Store distribution and Firebase Cloud Messaging push for the Android companion app), covered by the EU-US Data Privacy Framework and Standard Contractual Clauses — no time-tracking, payroll, or activity-classification data is routed through it beyond what a push notification itself contains; model inference for AI employees, which since 2026-09-16 runs through the OpenRouter gateway (United States) to an inference provider that is also in the United States — Anthropic for the advanced and frontier tiers, and Fireworks AI, Together AI, DeepInfra, Parasail or CoreWeave for the open-weight models the fast and balanced tiers run, plus fal.ai, reached through Vezoft's fleet service rather than through the gateway, for the images of AI employees hired as graphic designers. That channel processes the content an AI employee works with — never activity-classification, hours or payroll data — under Standard Contractual Clauses. We do not claim EU residency for model inference, and we cannot buy it self-serve: the gateway offers Vezoft no EU-region routing option, so we disclose the transfer rather than imply a residency we do not have. Third, website previews that AI employees deploy are held and served by Cloudflare Pages on its global network rather than in the EU, under the Standard Contractual Clauses and EU-US Data Privacy Framework in Cloudflare's DPA; a preview carries whatever the AI employee built, is public — anyone who has or finds its address can open it — and is deleted automatically 30 days after it is made, or sooner (see “Notes on Cloudflare”). Fourth, web search by AI employees hired as content writers, SEO specialists, team leads or AI Executives, from the day Vezoft switches it on: Vezoft's fleet service sends the text of each query directly to Anthropic in the United States, which runs the search with its own search sub-processors, under the Standard Contractual Clauses in Anthropic's Data Processing Addendum (see “Notes on Anthropic”). The AI employee's own computer, its recordings and every TimerOS record stay in the EU (Hetzner, Cloudflare R2, MongoDB Atlas).

Notes on MongoDB Atlas

• Atlas AI features disabled for tenant clusters. Atlas Vector Search and any generative-AI / embedding services that would route through US-based downstream providers are disabled on tenant clusters. TimerOS does not use these features for Customer Personal Data.
• Activity classification is on-device. The desktop app assigns an activity category entirely on the user's own machine using a two-layer engine: a deterministic, scored rule engine, with a small on-device statistical classifier as a fallback. There is no model download, no inference server, no GPU dependency, and no network call from the classifier. Raw window titles and application names are never sent off the device for classification — only the resulting label and confidence are transmitted to the TimerOS API as time-entry telemetry and stored in MongoDB Atlas. Full documentation of the classifier (architecture, training data, evaluation) is maintained in the TimerOS model card and made available to competent authorities on request.
• DPA archive. Vezoft archives a dated snapshot of the MongoDB DPA in its Article 30 records each time MongoDB publishes a material change.

Notes on Render

• Why a hosting provider is needed. Render runs the API, the website, and the client portal. The EU service is deployed in Frankfurt (AWS eu-central-1) so that application compute and any data in transit through it remain in the EU.
• No persistence at the hosting layer. Customer Personal Data is persisted in MongoDB Atlas (and uploaded files in Cloudflare R2), not on Render instances; data on a Render instance is transient request/response state and logs.

Notes on Cloudflare

• R2 object storage is EU-pinned. The bucket used for uploaded project files is created with Cloudflare's EU jurisdictional restriction, so uploaded files are stored in EU data centres.
• CDN / reverse-proxy / WAF. Cloudflare also fronts the Service for DNS, content delivery, and security (DDoS / web application firewall). In that role its edge processes end-user IP addresses, request metadata, and terminates TLS at the nearest global point of presence. The CDN edge is global by design; the stored R2 data is EU-pinned.
• AI-employee screen recordings. Recordings of an AI employee's virtual desktop, kept for its manager's review, are stored in the same EU-jurisdiction R2 storage and deleted automatically after 14 days.
• AI-employee website previews (Cloudflare Pages). When an AI employee builds a website for a task, it can deploy the build as a preview so that people can look at it before anything goes live. Previews are hosted in one Cloudflare Pages project on Vezoft's own Cloudflare account, at *.timeros-previews.pages.dev addresses. A preview is public: there is no login in front of it, and anyone who has or finds its address can open it. Besides the long random link an AI employee shares, Cloudflare also gives every preview a short deployment address that is far easier to guess, and both addresses open the same content. Previews are served with X-Robots-Tag: noindex, so search engines do not index them. A preview contains whatever the AI employee built, which can include the Customer's or its clients' content and any personal data in it. Pages cannot be pinned to the EU, so previews are held and served on Cloudflare's global network, not in the EU-pinned R2 storage. Previews are deleted automatically: each one 30 days after it is made, and immediately when the AI employee that made it is offboarded or the workspace is deleted. Deletion takes a preview down at both of its addresses. To have a preview deleted sooner, or all of a workspace's previews, email [email protected], with the link if you have it. Vezoft's fleet service records which AI employee and workspace each preview belongs to, its link and when it was made, but not its content.

Notes on Lettermint

• Why a transactional email provider is needed. TimerOS sends system-generated emails (password resets, email verification, sub-processor-change notices, material legal-change notices, invoice copies, team invitations). Sending these from a self-operated SMTP server is impractical because of deliverability filtering by Gmail / Outlook / Yahoo. Lettermint handles deliverability, bounce processing, and delivery receipts — the latter is important for proving that, for example, a 30-day sub-processor change notice was actually delivered.
• EU/EEA-only processing. Lettermint B.V. is a Netherlands entity and runs its own EU infrastructure (Autonomous System AS213427): primary hosting on UpCloud (Netherlands) with backup on OVHcloud (France). The sending domain (mail.timeros.ai) is served from this EU infrastructure and email data is encrypted at rest in EU data centres; there is no AWS/Google/Microsoft in the email path. All processing takes place within the EU/EEA (EU-to-EU), so no EU-US Data Privacy Framework and no Standard Contractual Clauses are required for the email payload (Lettermint's own DPA references SCCs only as a contingency). Only the recipient details and the content of the system email itself are processed — no database records are shared with Lettermint. Email is transmitted over TLS-encrypted connections, and message content and delivery/engagement metadata are retained only as long as needed to deliver the message and provide deliverability reporting. Post-termination, Lettermint deletes data within 30 days; Lettermint's DPA is at https://lettermint.co/dpa and its sub-processor list at https://lettermint.co/subprocessors.
• Transactional only. Vezoft uses Lettermint strictly for transactional email — not for newsletters, drip campaigns, or marketing automation. Any future marketing email would be disclosed by a sub-processor-list update and a Privacy Policy update.
• Notice-period commitment. Vezoft commits to 30 days' prior notice to Customers before adding or changing any sub-processor in this list.

Notes on Zoho

• EU-resident business mailboxes. Vezoft's business inboxes (support@, hello@, privacy@, security@) run on Zoho's EU service (zoho.eu, Zoho Corporation B.V.), with data in Zoho's EU data centres (Amsterdam and Dublin). Inbound mail to privacy@ and security@ routinely contains personal data (data-subject requests, security reports), which is why Zoho is listed as a sub-processor.
• EU posture. For the EU service, Zoho does not process this email data outside the EEA.

Notes on Google LLC

• Scope — Android companion app only. Google LLC is engaged only for the TimerOS Android companion app, which is a review-and-management dashboard: like the web dashboard, it does not track time and does not run the activity classifier — those remain on the Windows desktop. The desktop application, the web application, the marketing/admin website, and the client portal do not route through Google.
• iOS planned. When TimerOS launches its iOS app, Apple, Inc. will be added here as a separate sub-processor for App Store distribution and APNs push, with 30 days' prior notice to Customers per the procedure above.
• What FCM sees. If your tenant has enabled in-app push notifications, FCM receives the notification payload (subject line and body) for delivery to your device. The payload contains only data the Customer chose to push to its workforce; we do not route activity-classification telemetry through FCM.

Notes on Anthropic

• Why a model provider is needed. An AI employee is driven by a large language model. Vezoft trains and hosts no such model. Since 2026-09-16 the Claude models are called through the OpenRouter gateway under Vezoft's own gateway account, and the advanced and frontier tiers route to them; until that date they were called directly against Anthropic's API under Vezoft's own Anthropic account. Vezoft never resells raw model access.
• What Anthropic receives, and what it never receives. Prompt content of an AI employee's sessions, as listed in the table: the work it is assigned, what is said to it, what it is told to read, screenshots of its own virtual desktop, and — for an AI team lead where the workspace has turned scouting on — the short directory of projects open to AI work described in Section 5 of the AI Employees Notice. It never receives activity-classification output, hours maps, activity status, pay, payroll, tax identifiers, dates of birth, home addresses or emergency contacts of any person — the AI employee's own access is that of a member-role user (for an AI team lead, of a team lead over its AI team) without financial permissions, and those fields are stripped before anything reaches it. From version 1.29 of the AI Employees Notice it also receives the whole of a mail (sender, recipients, subject, text, attachment list and the text of plain-text attachments) that a Customer's AI employee reads from a mailbox a person gave it, and the reply it drafts; mail that TimerOS holds back — about a person, money or a legal matter — never reaches it this way. From version 1.30 it also receives the messages of a client's conversation in TimerOS chat that a Customer's AI employee on that client's project reads and, for Vezoft's own AI support engineers, the text of the support tickets of Vezoft's customers, never the customer's e-mail address, with the drafts they write; a ticket that TimerOS recognises as about a job applicant, pay, a contract or a personal-data request never reaches it this way.
• US processing, disclosed. Anthropic processes this content in the United States, and neither Anthropic nor the gateway offers Vezoft an EU-pinned inference region. The safeguards are the Standard Contractual Clauses in Anthropic's Data Processing Addendum, the Standard Contractual Clauses in OpenRouter's agreement for the routing hop, Anthropic's contractual commitment not to train on API inputs and outputs, zero-retention routing pinned on every request, and prompt minimisation at source. Enterprise Customers who require EU inference may run the models on their own Amazon Bedrock or Google Vertex AI project in an EU region under the bring-your-own-key mode described in the Terms; in that mode the provider is the Customer's processor, not our sub-processor.
• Web search, called directly. An AI employee hired as a content writer, SEO specialist, team lead or AI Executive can search the web during a work session, from the day Vezoft switches web search on. The search goes from its computer to Vezoft's fleet service (Hetzner, EU), which alone holds the key for it — a key used for nothing else, never put on an AI employee's computer — and calls Anthropic's web search tool under Vezoft's own Anthropic account, not through the gateway. Anthropic runs one search per query with its own search sub-processors, which its published sub-processor list names as Brave Search and TurboPuffer (United States): they are Anthropic's sub-processors, bound by Anthropic, not Vezoft's. A small Claude model (Claude Haiku) then reads the results and writes one line on each — its address and one sentence on what the page says about the query — and the fleet passes back each result's title, address and that line, which go to the AI employee and, as prompt content, to the model providers above. At most 100 searches a day per AI employee, counted within its daily limit of 300 pages and searches through the fleet.
• What Anthropic receives for a search. The query text, and nothing else about the AI employee, the Customer or any person: the request comes from Vezoft's fleet service, under Vezoft's account, with a fixed instruction to search once and describe the results. The AI employee writes the query, and its instructions forbid putting a client's confidential details or a person's private data in one; that is an instruction, not a technical check, so a query can still carry personal data — a name it is researching, for example. Vezoft's fleet logs which AI employee searched and how long the query was, never its text, for 90 days, and deletes that log with the workspace.
• On which terms. For Vezoft's own Anthropic account, the contracting party under Anthropic's Commercial Terms is Anthropic Ireland, Limited. Anthropic's Data Processing Addendum, incorporated in those terms, covers the queries and their results as personal data submitted through its services, with the Standard Contractual Clauses (Modules 2 and 3) for the transfer to the United States, and Anthropic commits not to train on them. These calls do not go through the gateway, so its zero-retention routing does not cover them: Anthropic's standard retention applies — by its published policy, inputs and outputs are deleted within 30 days, and kept longer only where its usage policy or the law requires — and we do not claim zero retention for them.
• Why Brave Software is no longer listed. Version 1.8 of this page added Brave Software, Inc. for web search through its own Search API, to be engaged only once Brave was bound, for query data, by terms meeting Section 6(d) of the DPA. Web search was never switched on through it, so Brave processed nothing for Vezoft, and it was removed in version 1.9 when web search moved to Anthropic. Brave Search remains one of the search providers Anthropic itself uses, as Anthropic's sub-processor under Anthropic's terms.
• Engaged from 2026-09-15. Added to this page on 2026-09-13 and engaged from 2026-09-15. No notice period had to run first: at that date the Service had no Customers, so there was no one to notify and no one who could object. The 30-day notice commitment above applies in full to every sub-processor change after that date.

Notes on OpenRouter

• Scope — the primary model gateway for every tier. From 2026-09-16 OpenRouter is the single endpoint through which every AI-employee language-model call is made, on every tier. Image generation for the graphic designer role is the one exception: it goes from the AI employee's computer through Vezoft's fleet service to fal.ai, under fal.ai's own data-processing terms (Standard Contractual Clauses) — the gateway's zero-retention routing does not cover it. Web search is not an AI employee's own model call: Vezoft's fleet service sends it directly to Anthropic (see “Notes on Anthropic”). OpenRouter is an intermediary, not a model provider: it trains and hosts no model, it forwards the request to one of several upstream providers and returns the answer. The upstream providers reachable for AI employees are named in the table above — Anthropic for the advanced and frontier tiers, and Fireworks AI, Together AI, DeepInfra, Parasail or CoreWeave for the open-weight models the fast and balanced tiers run — and the exact model per tier is in the model card.
• Vezoft pins the route; the gateway does not choose freely. Every request carries an explicit provider allow-list, and fallback to any provider outside that list is switched off, so a request is refused rather than quietly re-routed. Providers that retain inputs or train on them are excluded (data_collection: deny), zero-retention routing is required, a provider that cannot honour a parameter we set must reject the request instead of ignoring it silently, and the numeric precision the model is served at is pinned so the same model cannot be served in a materially different form from one day to the next. Adding an upstream provider to that allow-list is a sub-processor change and carries the 30-day notice above.
• Where the prompt goes, stated honestly. The gateway itself is in the United States, and since 2026-09-16 every provider on the allow-list is in the United States too, so that is where model inference takes place. OpenRouter offers Vezoft no self-serve EU-region routing, so we cannot pin inference to the EU and we do not claim to. The safeguards are therefore the Standard Contractual Clauses in OpenRouter's data-processing agreement, passed down the routing chain to the upstream provider, and those in each provider's own terms; the no-training and zero-retention pinning described above; prompt minimisation at source (an AI employee never receives activity-classification output, hours, pay or any financial data about a person); and, for Customers who require EU inference, the Enterprise bring-your-own-key mode in the Terms, where the models run on the Customer's own EU Bedrock or Vertex project and that provider is the Customer's processor rather than our sub-processor.
• Prompt caching. To hold cost and latency down, the unchanging front of a request may be cached for a few minutes so it need not be re-processed on the next call. That is a short-lived processing cache at the provider, not storage for any other purpose, and it sits inside the same no-training and zero-retention terms.

Notes on the inference providers (Fireworks AI, Together AI, DeepInfra, Parasail, CoreWeave)

• Why they are listed. They run the open-weight models behind the fast and balanced AI-employee tiers, and the routine sub-agent on the advanced tier. Vezoft has no direct account with any of them: the request reaches them only through the OpenRouter gateway, on the route Vezoft pins. They are nevertheless engaged for Vezoft's purposes, on Vezoft's instruction, and they process the same prompt content the gateway row describes — so they are listed here as sub-processors of the inference step rather than hidden behind the gateway's name.
• What they receive, and what they never receive. The same prompt content as Anthropic: the work an AI employee is assigned, what is said to it, what it is told to read, screenshots of its own virtual desktop, and — for an AI team lead where the workspace has turned scouting on — the short directory of projects open to AI work. They never receive activity-classification output, hours maps, activity status, pay, payroll, tax identifiers, dates of birth, home addresses or emergency contacts of any person — those are stripped before anything reaches the AI employee at all. From version 1.29 of the AI Employees Notice they also receive, for the tiers that route to them, the whole of a mail that a Customer's AI employee reads from a mailbox a person gave it, and the reply it drafts; mail that TimerOS holds back never reaches them. From version 1.30 they also receive, for those tiers, the messages of a client's conversation and the text of a customer-support ticket that an AI employee reads, and the drafts it writes; a ticket that TimerOS holds back never reaches them.
• The models are of Chinese origin; the hosting is not, and that distinction is the whole point. GLM and Qwen are open-weight models published by Chinese companies. Running one of them is executing a published file of weights on somebody else's hardware; it is not sending anything to the company that published it. What a transfer analysis turns on is where a request is served, and every provider that may serve one of these models for an AI employee is a US company on Vezoft's allow-list, each verified on 2026-09-16 to support the tool calling and image input the agent needs. An AI employee puts a screenshot of a Customer's desktop on the wire at nearly every step, which is why the hosting question was settled first and the model's provenance second.
• Why Alibaba Cloud and Z.AI are no longer listed. Until 2026-09-16 this page named them as sub-processors, because the line-up then contained models that each of those vendors alone served. The endpoint audit of 2026-09-16 removed those models from the line-up: a single serving endpoint is a single point of failure that happened also to be a single jurisdiction. The models that remain are served by the US providers above, so the vendors themselves process nothing for Vezoft and are not sub-processors.
• Where, and what secures it. The United States, for all of them. The safeguards are the ones in “Notes on OpenRouter”: Standard Contractual Clauses passed down the routing chain and in each provider's own terms, a no-training and zero-retention policy required of any provider before it is admitted to the allow-list and pinned on every request, fallback outside the list disabled, and prompt minimisation at source. A Customer that cannot accept US inference can object under the procedure below, or use the Enterprise bring-your-own-key mode and run inference on its own EU project.

Notes on fal.ai

• Images only, for graphic designers. fal.ai generates the images an AI employee hired as a graphic designer asks for — imagery for social and marketing visuals — from the text prompts it writes. The request goes from the AI employee's computer to Vezoft's fleet service (Hetzner, EU), which adds Vezoft's key and passes it to fal.ai — not through the OpenRouter gateway — and the image comes back the same way, in the response; the fleet service keeps neither the prompt nor the image, and fal.ai sees the fleet service's address, not the computer's. It receives the prompt and returns the image; it receives no TimerOS records, no chat, and no data about people beyond what a prompt happens to say. fal.ai's own data-processing terms (Standard Contractual Clauses) and retention terms apply: the gateway's zero-retention routing does not cover these requests, and we do not claim zero retention for them.
• Also used for Vezoft's own marketing material. Vezoft has used fal.ai for its own promotional content, which involves no Customer data; it becomes a sub-processor only through its use for AI employees.

Notes on Hetzner

• The AI employee's own computer. Each AI employee works on its own virtual machine on Hetzner Cloud in the EU — created from a template image, with no public network address of its own, in a private network that Vezoft runs for that Customer's AI employees only. Its connections to the internet pass through one gateway machine in that network, which Vezoft also runs at Hetzner (EU): the gateway machine lets a connection through only to a host on that AI employee's list — the TimerOS API, the model providers, the hosts the Customer's manager has allowed and, added for it automatically, the live websites a person linked to its projects and github.com while a repository is linked, as well as the software update servers that Vezoft opens for every machine — by the host's name, connecting to the address that name leads to and never to one the machine chose; it answers the machine's name lookups only for those hosts and refuses everything else. For each AI employee and day, the gateway machine reports to Vezoft's fleet service the names of the hosts its machine connected to, with the number of connections and the amount of data, and the names it was refused; the fleet service keeps these records for 90 days and deletes them with the workspace, and the gateway machine keeps a line per computer, host and minute for up to 7 days. None of these records holds a page, a form or a file. Where an allowed host shares a network with other sites, those sites may in rare cases still be reached by name, on networks that do not refuse it. Any other public web page is meant to be read as plain text, through a logged fetch proxy on Vezoft's fleet service (also on Hetzner, EU): no login, no cookies, the site's robots rules honoured, a daily limit per AI employee, and a log of which AI employee fetched which address — without its query string — and how much, kept for 90 days and deleted with the workspace; its web searches go through the same fleet service to Anthropic (see “Notes on Anthropic”). It is powered off outside the AI employee's shifts and deleted at offboarding (a disk snapshot is kept for 30 days).
• What is on the machine. The working files, browser profiles and downloaded content of the AI employee's tasks — the repositories it cloned included — and its own screenshots. Since the AI Employees Notice, version 1.14, also: its memory file (up to 3,000 characters of work facts, the workspace's conventions and lessons, copied to TimerOS after each session); the skills it writes for itself, which also appear in TimerOS, and the files a skill keeps beside it — references, scripts, templates — which stay on the machine only; and its session database: the full record of each of its work sessions — the prompts it was given (its brief, its persona, the workspace's organisation and the chat messages), the results of its tools, its replies and its reasoning text — which it can search for its earlier work, and from which a session is deleted 30 days after its last activity. The session database can hold personal data. It is not copied to TimerOS and is not carried to a new machine when the AI employee moves, but it is in the snapshots of the machine's whole disk (kept 7 days after a move and 30 days after offboarding), and it is deleted with the machine when the AI employee is offboarded. No account secret or OAuth token is stored on the machine; those stay in a vault on Vezoft's fleet service and are injected at the moment of use. The AI employee's own model key — with a monthly spending limit that Vezoft sets at the gateway, and revoked when the AI employee is offboarded — is held by the machine's own service and never written to its disk; a short-lived repository key, when one is issued, is held only in the memory of the machine's own service and used on the AI employee's behalf — no program it runs ever receives it. The Customer's gateway machine holds the connection records and the list of websites each of that Customer's AI employees may reach, and no other data.
• Updates and moves to a fresh machine. Vezoft updates the software on the machine between the AI employee's work sessions; every update is signed by Vezoft, and the machine refuses one that is unsigned or altered. When the template image itself changes, the AI employee moves to a fresh machine, normally outside its shifts. The old machine is shut down and a snapshot of its whole disk is taken. A short-lived helper machine with no public network address, started from that snapshot, sends the AI employee's work folder — its workspace and its Desktop, Documents, Downloads and Pictures folders, never its browser profile, the settings files elsewhere in its home folder, or common caches — over the Customer's private network and Vezoft's encrypted link to Vezoft's fleet service, which stores it encrypted (at most 2 GiB compressed) and deletes it as soon as the move ends, whether it succeeded or not. A new machine is created from the new image as the same AI employee, and the work folder is restored onto it. The helper is deleted once it has sent the folder, the old machine once the new one is healthy (if the move fails, the old machine is switched back on and the new one is deleted), and the disk snapshot 7 days after it was taken. The machine has no public network address of its own.
• EU processing. Hetzner Online GmbH is a German company processing in Germany or Finland; no transfer safeguard is required. Screen recordings of the machine for the manager's live view are stored in Cloudflare R2 in the EU (see Notes on Cloudflare) for 14 days.

AI assistants connected by users are not sub-processors. A user may connect an AI assistant of their own choosing (for example Claude, made by Anthropic) to their own TimerOS account through the TimerOS connector; that assistant then receives workspace data on the user's instruction, within the scope the user approved and limited to what the user can already see. The assistant provider is engaged by the user — not by Vezoft — under the provider's own terms; Vezoft has no contract with it, does not control what it does with the data, and does not process data on its behalf. Such providers are therefore not sub-processors within the meaning of this page or the DPA, are not listed above, and are not subject to the 30-day notice and objection procedure. A workspace owner or administrator can turn assistant connections off for the whole workspace in Settings → Connections; see Section 4A of the Privacy Policy.

AI employees are the opposite case: their providers are Vezoft sub-processors. Where a Customer hires an AI employee (Section 2B of the Terms), the routing gateway (OpenRouter), the model providers it routes to (Anthropic for the advanced and frontier tiers — Anthropic is also called directly for the web search of AI employees hired as content writers, SEO specialists, team leads or AI Executives; Fireworks AI, Together AI, DeepInfra, Parasail or CoreWeave for the open-weight models the fast and balanced tiers run), the image provider, reached through Vezoft's fleet service, for AI employees hired as graphic designers (fal.ai) and the hosting provider (Hetzner) are engaged by Vezoft, under Vezoft's own accounts and data-processing terms, to process Customer Personal Data on the Customer's behalf. They are listed in the table above, they are subject to the 30-day notice and objection procedure, and the AI Employees Notice explains to staff and clients what an AI employee sees and where it goes.

GitHub is not a sub-processor. Where a person on the Customer's side links a repository to a project, GitHub, Inc. is the Customer's own code host: the Customer holds the account, installs the TimerOS GitHub App on it, chooses which repositories the App may see, and configures the repository, its branch protection and its location (for most accounts the United States; GitHub Enterprise Cloud offers EU residency). Vezoft owns the TimerOS GitHub App under GitHub's developer terms and uses it only to act inside the Customer's account on the Customer's instruction — to read the linked repositories for the AI employee; after a specific push is approved — by a person, by an AI Executive above the AI employee, or under a person's standing permission — to push that one branch and open a pull request; and, only on an approved merge request, to merge that pull request through Vezoft's fleet service, after reading its checks. GitHub processes the repository for the Customer, not on Vezoft's behalf, so it is not listed above and is not subject to the 30-day notice and objection procedure; the repository content Vezoft itself processes — on the AI employee's computer and, as prompt content, at the model providers — is covered by the Hetzner, OpenRouter and model-provider rows.

Affiliates

Vezoft currently operates without affiliated entities. If we form affiliates in the future and they process Customer Personal Data on our behalf, they will be added to this list as sub-processors with notice as above.

How to object to a new sub-processor

Email [email protected] within 30 days of notification, stating your concern. We will work with you to find an acceptable alternative. If we cannot, and you cannot in good faith use the Service with the new sub-processor, you may terminate the relevant Order Form on written notice and we will refund any prepaid fees covering the period after termination.

Inquiries

[email protected] / Vezoft, with registered office in Kardzhali, Bulgaria (see Imprint for the full registered address).