Sub-processors
Draft — pending legal review. Not yet in force.
Last updated: 29 October 2026
Service providers that [not configured: legal name] uses to run Gauntlet Cloud, this website and the license store, and that may process personal data. Self-hosted Gauntlet sends us nothing but license renewals.
1. Current sub-processors
Amazon Web Services EMEA SARL (Luxembourg)
- Purpose
- Hosting of Gauntlet Cloud and this website: servers, storage, DNS
- Data
- All data, including Customer Content in test environments and run results
- Location
- EU: Stockholm, Sweden (eu-north-1)
- Safeguard
- EU hosting; AWS Data Processing Addendum with SCCs for any onward transfer
Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA)
- Purpose
- Payments, subscriptions, invoices, tax calculation, billing portal
- Data
- Billing contact and email, company name, billing address, tax ID, payment details, subscription data
- Location
- EU and USA
- Safeguard
- EU-US / Swiss-US Data Privacy Framework (Stripe, Inc.) and SCCs
[to confirm: email delivery provider]
- Purpose
- Sending emails: sign-in links, licenses, invitations, billing notices
- Data
- Recipient email, message content
- Location
- [to confirm]
- Safeguard
- [to confirm]
[to confirm: mailbox provider]
- Purpose
- Business email: messages to and from sales and support
- Data
- Correspondence, including logs or screenshots customers send with support requests
- Location
- [to confirm]
- Safeguard
- [to confirm]
2. Not our sub-processors
- Your model provider (on Gauntlet Cloud: Anthropic). You bring your own API key and contract with the provider directly. The test agent's requests pass through our model proxy, which adds your key and forwards them, with page text, screenshots and logs from your environments, to the provider's API; we do not store the request content, only usage counts. The provider processes the requests under your agreement with it.
- Your identity provider (Google). You choose to sign in with it; it authenticates you under its own terms and acts as an independent controller.
- Services you connect: container registries, Git hosts, and accounts used by kits in real mode (e.g. your Stripe test account or Google OAuth client). You choose and contract with them.
3. Changes
We announce new or replaced sub-processors on this page, with the date, and by email to organization owners at least 30 days before they process Customer personal data. Customers may object as set out in the DPA. Questions: [not configured: legal contact email].