Sub-processors
Version 1.0 · Effective 1 November 2026
Sub-processors and ICT subcontractors
Algora S.A. · Last updated: [PUBLICATION DATE]
This page lists the providers that Algora S.A. uses to deliver its platform. It reproduces Annex III of the Algora Data Processing Agreement (version 1.0 of 1 November 2026).
How we notify changes
We inform our customers by email of any intended addition or replacement of a sub-processor at least thirty (30) days in advance, or at least three (3) months in advance where a regulated customer is concerned and the change involves a new country or region of processing (Section 6.2 of the Data Processing Agreement). Customers may object on reasonable grounds relating to data protection within that period.
Current list
This list is current at the date of this version of the DPA; later changes are notified in accordance with Section 6.2. The providers below receive only what is stated. Providers that receive no Customer Personal Data are not Sub-processors within the meaning of Section 6 and are listed for transparency and for the Customer's register of information under DORA. Queries sent to search, news and market data providers are generated as entity and ticker terms; the Customer's raw prompts are never forwarded, and every outbound request is logged.
| Provider | Service and data received | Location of processing | Transfer basis and safeguards |
|---|---|---|---|
| Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland | Hosting, databases, file storage, backups and logging of the Service. All Customer Data. | European Union, Google Cloud region europe-west3 (Frankfurt, Germany) | Processing in the EU, no transfer outside the EEA. Google Cloud data processing terms. Encryption in transit and at rest. |
| Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland | AI model inference (Google Gemini models through Vertex AI). Prompts and context, which may include Customer Personal Data. | European Union (Vertex AI EU multi-region: processing may take place in any Google Cloud region within the EU) | Processing in the EU, no transfer outside the EEA. No use of Customer Data for model training. Prompts may be cached by Google for up to 24 hours to improve performance and are then deleted. |
| Daytona Platforms, Inc., New York, United States | Code execution sandbox for analyses and workflows. Generated code and the files and data used in a session, which may include Customer Personal Data. The sandbox has time-limited access to the files available to the Authorised User in the Service. | European Union for sandbox execution and storage (Frankfurt, Germany). United States for technical and audit logs, telemetry, Algora's software image (no Customer Data) and remote access by Daytona staff for operations and incident response. | Sandbox execution and storage in the EU region. As Daytona is established in the United States, the technical logs kept there and any access by Daytona from outside the EEA constitute a transfer, covered by the standard contractual clauses (module 3, processor to processor) agreed between Algora and Daytona and a transfer impact assessment. Technical logs do not contain file contents or the output of code execution. Persistent sandbox per Authorised User, stopped when idle; its contents and backup copies are stored in the EU region and deleted in accordance with Section 10. |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Email and collaboration (Microsoft 365) used for Algora's support mailbox and internal communications. Support correspondence and any documents or screenshots the Customer sends to Algora's support address, which may include Customer Personal Data to the extent the Customer includes it. | European Union (Microsoft EU Data Boundary) | Processing in the EU under the Microsoft EU Data Boundary. Microsoft Products and Services Data Protection Addendum, including the standard contractual clauses for any residual transfer. Not a Sub-processor for data the Customer accesses through its own Microsoft 365 connector (see Annex I, Connectors). |
| NFT S.à r.l., 40, rue Mathias Koener, L-4174 Esch-sur-Alzette, Luxembourg | Software development, technical maintenance and support of the Service. Access to Customer Data only where needed for maintenance and support. | Luxembourg, within Algora's environments | No transfer. Data processing agreement with Algora. |
| AlphaAI Technologies Inc. (Tavily), New York, United States | Web search. Search terms only (entity names, tickers). Not intended to contain Customer Personal Data. | United States | Search terms are filtered to remove client identifiers before they are sent (filter being rolled out). The provider's data processing terms, including standard contractual clauses and retention, are being confirmed. |
| Utradea Inc. (Financial Modeling Prep), Toronto, Canada | Market data and fundamentals. Tickers, identifiers and date ranges only. No Customer Personal Data. | Canada | No personal data sent. Canada benefits from an adequacy decision of the European Commission. |
| NewsAPI.ai, Ljubljana, Slovenia | News events. Keywords, tickers and date ranges only. No Customer Personal Data. | European Union (Slovenia) | No personal data sent. Processing in the EU. |
| Infisical, Inc. (United States) | Management of Algora's technical credentials (API keys). No Customer Data. | European Union (EU servers only) | No Customer Data. Processing in the EU. |
Contact
Questions about this list: info@algora.lu