Legal & trust
Sub-processors
Effective 2026-10-19 · version 2.0
Thalius AI AB (organisation number 559528-5635, VAT SE559528563501, Slipgatan 5, 117 39 Stockholm, Sweden) uses the following sub-processors to process customer documents, questions and account data in the Thalius Hippocampus service. They are listed by processing stage. This list is Annex 2 of the data processing agreement.
| Stage | Sub-processor | Region | What is processed |
|---|---|---|---|
| Cloud platform, document storage, core processing | Google Cloud | EU (Finland, europe-north1) | Encrypted documents (per-document keys, workspace-bound, wrapped in Cloud KMS); the knowledge structure; usage records; conversation logs, public chat logs and push subscriptions |
| Identity | Google Cloud Identity Platform | EU | Account email, sign-in events |
| Sign-in with a third-party account (only the provider you choose) | Google, Microsoft, Apple, GitHub | US, under the EU–US Data Privacy Framework or Standard Contractual Clauses | Your sign-in request; the provider sends us your email and name |
| Text extraction (OCR) | Mistral AI (France) | EU | Page images and extracted text of uploaded documents, transiently |
| Document structure and figure classification | OpenAI | US | Document text fragments, transiently |
| Summaries, embeddings and result selection | Google (Gemini) | US by default; EU-hosted endpoint on request | Document text fragments, transiently |
| Answer generation | OpenAI, Google or Anthropic, as configured per workspace | US by default | Retrieved fragments and the question, transiently |
| Search index | Typesense Cloud (Typesense, Inc.), managed cluster on AWS in Stockholm | EU (Sweden) | Indexed text and embeddings, per workspace |
| Application and API edge | Cloudflare | Global edge | Requests and answers in transit; nothing is stored there |
| Push notifications (only when a visitor allows them) | Apple, Google and Mozilla push services | US | An encrypted payload and a device token |
| Payments and invoices | Stripe Payments Europe Ltd (Ireland) | EU/US | Billing address, VAT ID, invoices, payment status; card details are held by Stripe only |
| Connector (only when you connect it) | Google Drive API | EU/US | Files and folders you pick for import |
| Connector (only when you connect it) | Centuri (Centuri AB, Stockholm), your organisation's own Centuri system | EU | Documents you pick for import |
| Service email | Google Workspace (support@thalius.ai) | EU/US | Email address and message |
Sovereignty option: for customers who require it, every component including model inference can run EU-hosted or in the customer's own environment; this is a deployment configuration available on Corporate.
None of these providers may use customer data to train models. Each one is bound by data protection terms equivalent to the DPA. Transfers to the United States rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses.
Changes to this list are announced on this page with a new effective date, and by email to workspace owners, at least 30 days before they apply. Workspace owners may object as set out in the DPA.
Providers that process data about site visitors only (analytics) are listed in the privacy notice.
Questions: privacy@thalius.ai