Security & Subprocessors

Legal Documents

Questions? legal@cloudsigma.com

Security & Subprocessors

Last updated: 6 September 2026 · Effective: 1 March 2026

1. Infrastructure

Hosting: CloudSigma AG production cloud infrastructure in Switzerland.
Cloudflare: Edge networking and reverse proxying for service traffic, including connections carrying upstream inference requests and long-lived streaming/session responses. This processing uses Cloudflare's international network and is distinct from CloudSigma's Swiss production hosting.
Database: CloudNativePG (CNPG) PostgreSQL clusters with TLS in transit and AES-256 at rest.
API Gateway: Deployed on Kubernetes (K3s), behind TLS-terminating reverse proxies (Caddy).
Network: All internal service communication is encrypted. Public endpoints are HTTPS-only (TLS 1.2+).

2. Authentication & Access Control

API keys are hashed with SHA-256 before storage; raw keys are shown only at creation time.
OAuth tokens for model providers are stored encrypted at rest.
Portal login uses OAuth 2.0 (Google) with session cookies. Sessions expire after inactivity.
Admin access is role-based: owner, taas_admin, org_owner, org_admin, user. owner and taas_admin are platform-level roles; org_owner and org_admin are organisation-scoped roles.

3. Data Security

API request content is processed to fulfil requests. Redacted diagnostic and quality captures may be retained where enabled under the applicable service and organisation settings, with configured expiry and purge controls. Full quality capture is disabled by default per organisation; limited error-result capture is separately controlled and remains subject to service-level capture gates.
Usage metadata (timestamps, token counts, model names) is retained for billing and logged to the portal database.
Audit logs for administrative actions are immutable (database-level triggers prevent modification).

4. Vulnerability Management

Dependencies are monitored for known CVEs with automated tooling.
Security patches are applied within 7 days for critical vulnerabilities, 30 days for others.
To report a vulnerability, contact security@cloudsigma.com. We operate a responsible disclosure programme with a 90-day embargo window.

5. Incident Response

In the event of a personal data breach, we will notify affected customers within 72 hours of becoming aware, per GDPR Article 33. Notifications include the nature of the breach, data categories affected, likely consequences, and remediation measures taken.

6. Sub-processors

We engage the following subprocessors who may process your data or API request content:

Sub-processor	Purpose	Location
OpenAI	LLM inference	International; regional processing subject to service agreement
Anthropic PBC	LLM inference	United States; other locations subject to service agreement
Amazon Web Services (Amazon Bedrock)	LLM inference	United States, Germany, Ireland, Japan, Singapore; service-region dependent
Google LLC (Gemini API)	LLM inference	International
Mistral AI SAS	LLM inference	EEA; international transfers subject to safeguards
Alibaba Cloud (Model Studio)	LLM inference	Singapore; service-region dependent
Moonshot AI	LLM inference	International; specific processing location subject to service agreement
Nebius AI	LLM inference	International; specific processing location subject to service agreement
DeepInfra	LLM inference	United States
Groq	LLM inference	United States and other international locations
MiniMax	LLM inference	International; specific processing location subject to service agreement
DeepSeek	LLM inference	China
Z.AI (Zhipu AI)	LLM inference	International; specific processing location subject to service agreement
SiliconFlow	LLM inference	Singapore and other international locations
OpenRouter	LLM inference	International
Cloudflare, Inc.	Edge networking and reverse proxying, including upstream inference and streaming/session connections	International
Stripe	Payment processing	United States and other international locations
Google LLC	Account sign-in	International
Calendly	Optional appointment scheduling	United States and other international locations
CloudSigma AG	Production infrastructure hosting	Switzerland

Locations describe supplier processing scope, not exclusive residency guarantees. Actual processing depends on the service agreement and enabled regional controls. Where a specific location is not confirmed, it is identified as international rather than inferred from company headquarters. CloudSigma production hosting in Switzerland does not imply Swiss-only processing by external suppliers.

Last updated: 6 September 2026. We notify customers of material subprocessor changes with at least 14 days' notice.

7. Compliance

A Data Processing Addendum describes processing obligations and international-transfer safeguards. CloudSigma production hosting is in Switzerland; external supplier locations are listed above.
Swiss nDSG (revised Federal Act on Data Protection) applicable as Swiss-domiciled controller.