WASH AI Subprocessors
Last updated: 22 October 2026
This page is the list of Subprocessors referred to in paragraph 5 and Annex C of the WASH AI Data Processing Agreement, and in section 6 of the Privacy Policy. It applies to all WASH AI tenants.
WASH AI is operated by Mills IT Consulting Ltd, trading as Baobab Tech, a company incorporated in Alberta, Canada. For tenant data, Baobab Tech acts as processor on behalf of each tenant.
1. Changes to this list
- Baobab Tech gives each tenant's designated representative at least 30 days' notice by email before adding or replacing a Subprocessor where the change would result in tenant personal data being processed in a new country or region, or in new categories or purposes of processing.
- Any other change is published on this page and notified to the designated representative by email no later than the date it takes effect.
- Previous versions are available on request.
2. Subprocessors for all tenants
| Subprocessor | Service | Data received | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. | Application hosting and serverless functions | All data passing through the application | EU (Frankfurt) | SCCs and UK Addendum, for incidental control-plane access |
| Vercel Inc. (Analytics and monitoring) | Product analytics and error monitoring | Usage events, error logs, truncated IP addresses | Multi-region | SCCs and UK Addendum |
| Databricks, Inc. (Neon) | Primary database, text search index, document pipeline database and backups | Stored tenant content and personal data, including embeddings and indexes | EU (Frankfurt) | SCCs and UK Addendum, for incidental control-plane access |
| Cloudflare Inc. (R2) | Document and figure storage | Uploaded documents and extracted figures | EU jurisdiction | SCCs and UK Addendum, for incidental control-plane access |
| Langfuse GmbH (EU cloud) | Observability traces, kept for up to 90 days | Prompts, outputs, tool calls, user and tenant identifiers | EU (Germany) | Not required |
| Translated S.r.l. (Lara) | Machine translation on the web and WhatsApp channels | Message text | EU (Italy) | Not required |
| Upstash Inc. | Session cache and rate limiting | User identifiers, IP addresses (for rate limiting), last active tenant | EU (Frankfurt) | SCCs and UK Addendum, for incidental control-plane access |
| Postmark (ActiveCampaign, LLC) | One-time passcodes and notification emails | Email addresses, names, minimal message content | United States | SCCs and UK Addendum |
| Meta Platforms Ireland Ltd and Meta Platforms, Inc. (WhatsApp Cloud API) | WhatsApp messaging, where enabled for the tenant | Phone numbers, profile names, message content | Germany, where local storage is enabled for the tenant's number, with message content processed outside the EU for up to 60 minutes during delivery; otherwise United States | EU-US Data Privacy Framework; SCCs and UK Addendum |
| Twilio Inc. | WhatsApp delivery for numbers hosted on Twilio | Phone numbers, message content, delivery logs | United States | EU-US Data Privacy Framework; SCCs and UK Addendum |
3. Subprocessors for tenants requiring AI processing within the EU
For tenants whose Order Form requires AI processing within the European Union, all AI inference, conversation titles and query embeddings are routed only to the Subprocessors below. Routing is enforced server-side and model selection is not offered to users.
| Subprocessor | Service | Data received | Processing location | Transfer mechanism |
|---|---|---|---|---|
| EUrouter B.V. | Chat inference, conversation titles, expert-request extraction and query embeddings (bge-m3). Each request is restricted to EU-owned providers with no retention and no training, currently Mistral AI, Scaleway, IONOS, OVHcloud and GreenPT | Prompts, retrieved tenant content, outputs | EU (Netherlands) | Not required |
| Google Cloud (Vertex AI) | Chat inference as backup to EUrouter; optical character recognition fallback during document ingest | Prompts, retrieved tenant content, outputs; document pages | EU (europe-west4, Netherlands) | Not required for processing; SCCs and UK Addendum for incidental access |
4. Additional Subprocessors for other tenants
For tenants without an EU processing requirement, the following are used in addition to those in section 2.
| Subprocessor | Service | Data received | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. (AI Gateway) | Routing of inference requests to model providers | Prompts, retrieved tenant content, outputs | Multi-region | SCCs and UK Addendum |
| Model providers reached through the Vercel AI Gateway or Google Cloud (Vertex AI) | Chat inference | Prompts, retrieved tenant content, outputs | Varies by model; may include the United States | SCCs and UK Addendum |
| Voyage AI (MongoDB, Inc.) | Query embeddings for search ranking, through the Vercel AI Gateway | Queries and candidate passages | United States | SCCs and UK Addendum |
5. Processing by Baobab Tech outside the UK and EEA
- Document ingest. Documents are converted on servers Baobab Tech owns and operates in Canada. These servers hold temporary copies and delete them when each ingest job completes.
- Remote access by personnel. Baobab Tech personnel and contractors may access tenant personal data remotely, for support and maintenance, from Canada and Malawi. All access requires multi-factor authentication.
6. Search services
Where web search is enabled for a tenant and no relevant document is found in the knowledge base, WASH AI sends search queries to Tavily and Serper. Where a user asks for research evidence, it sends search queries to OpenAlex. These services receive the query text only, with no user, tenant or account identifiers, and receive no tenant documents or conversation history. They are not Subprocessors.
7. Retention and deletion
Deletion under paragraph 9 of the Data Processing Agreement covers tenant content and every copy or representation derived from it, including text indexes, embeddings, extracted figures, caches and observability traces. Deleted data leaves the last backup within 5 weeks.
| Where | What it holds | Retention | On exit |
|---|---|---|---|
| Databricks (Neon), live databases | Documents, chunks, text indexes, embeddings, conversations, user records | Until deleted by the tenant or Baobab Tech | Deleted within 30 days after the exit period |
| Databricks (Neon), backups | Snapshots of the live databases | Daily snapshots kept 14 days; Monday snapshots kept 5 weeks; first-of-month snapshots kept 1 month; point-in-time recovery history kept 24 hours | Expire on schedule, at most 5 weeks after deletion |
| Cloudflare R2 | Uploaded documents and extracted figures | Until deleted | Deleted within 30 days after the exit period |
| Langfuse | Traces with prompts and outputs | 90 days, rolling | Tenant traces deleted within 30 days after the exit period |
| Upstash | Rate-limit counters keyed by user ID or IP address; each user's last active tenant | Rate-limit counters expire with the rate-limit window; the active-tenant setting expires 90 days after last use | Expire on schedule |
| Baobab Tech ingest servers (Canada) | Temporary copies of documents being converted | Deleted when each ingest job completes | Nothing retained |
| EUrouter and its providers | Prompts and outputs in transit | Zero retention, enforced on each request | Nothing retained |
| Google Cloud (Vertex AI) | Prompts and outputs in transit | In-memory caching disabled; otherwise per Google Cloud terms | Nothing retained by Baobab Tech |
| Meta (WhatsApp) | Message content and media | Media up to 30 days; message content as set by Meta | Outside Baobab Tech's control after delivery |
| Twilio | Message logs | Until deleted | Deleted within 30 days after the exit period |
| Postmark | Sent emails | 45 days | Expire on schedule |
| Translated (Lara) | Text in transit | Per provider terms | Nothing retained by Baobab Tech |
The exit period is the 30 days after a tenant's agreement ends. Backups support a recovery point objective of 24 hours, or less within the 24-hour point-in-time window, and a recovery time objective of one business day. Restores are tested quarterly.
8. Transfer mechanisms
- Canada. EU adequacy decision 2002/2/EC, covering organisations subject to PIPEDA, and the corresponding UK adequacy regulations.
- United Kingdom. EU adequacy decisions for the United Kingdom, renewed on 19 December 2025 until 27 December 2031.
- United States. The EU-US Data Privacy Framework and its UK Extension, where the Subprocessor is certified, with the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and the UK International Data Transfer Addendum in place as an alternative mechanism.
- Malawi and other countries without an adequacy decision. The EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
- A summary of Baobab Tech's transfer impact assessments is available to tenants on request.
9. Contact
Questions about this list: support@washai.org