Subprocessors
Vahti uses selected subprocessors to provide services such as infrastructure, payments, email delivery and customer communications. We publish an up-to-date list of subprocessors and update it as necessary. We will endeavour to notify customers of significant new subprocessors at least 30 days in advance.
Updated 23.4.2026
Subprocessors
Last updated: 24 May 2026
This page explains which subprocessors Vahti Service Oy uses to provide the vahti.ai service.
A subprocessor means a service provider that processes personal data on behalf of Vahti Service Oy, for example in connection with technical service delivery, billing, email delivery, or customer communications.
Not all providers listed below process actual service data obtained from the customer’s Microsoft 365 environment. Some providers primarily process Vahti’s own customer relationship, billing, communications, or website data.
| Service Provider | Purpose | Nature of Data Processed | Location / Data Residency | Additional Information |
|---|---|---|---|---|
| Google Cloud / Google Cloud EMEA Limited | Infrastructure, hosting, database, logging, monitoring, and technical service runtime. Google Vertex AI / Gemini may also process data to explain findings and generate guidance. | Customer company and user account information, service technical data, log data, and Microsoft 365-derived data necessary for service operation. | Vahti’s primary production infrastructure is located in the EU. Vertex AI / Gemini is configured to be used in EU locations. | Vahti’s contracting party for Google Cloud is Google Cloud EMEA Limited. Google Cloud / Vertex AI processes data to provide the service. Customer data is not used to train or fine-tune Google AI/ML models without the customer’s prior permission or instruction. |
| Stripe / Stripe Payments Europe, Limited and Stripe Technology Europe, Limited | Payments, subscriptions, billing, and payment transaction processing. | Customer company billing data, contact person information, payment transaction data, subscription and payment status data, and technical payment method identifiers. | Stripe operates in the EEA through Irish Stripe entities, but the service may involve processing or access from outside the EU/EEA. | Stripe does not generally process the customer’s Microsoft 365 tenant data. Transfer mechanisms are based on Stripe’s DPA, such as the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. |
| Postmark / AC PM, LLC | Email delivery, such as system messages, invitations, notifications, and other messages necessary for use of the service. | Recipient email address, name, company, message content, sending and delivery logs, and technical message metadata. | United States / possible processing outside the EU/EEA. | Postmark is not used for payment processing and is not used as a primary storage location for customer service data. Transfer mechanisms are based on Postmark’s DPA, such as the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. |
| HubSpot / HubSpot Ireland Limited | Website forms, lead and demo request processing, CRM, sales, and customer communications. | Contact person name, email address, phone number, title, company, contact request content, customer relationship and sales process data, and technical website and form data. | The HubSpot account is in the EU1 environment. HubSpot’s service may still involve processing or access from outside the EU/EEA. | HubSpot primarily processes website, sales, and customer relationship data, not actual Microsoft 365 tenant data. Transfer mechanisms are based on HubSpot’s DPA, such as EU Standard Contractual Clauses and/or other applicable transfer mechanisms. |
Changes to Subprocessors
Vahti Service Oy may update this list if the subprocessors used to provide the service change.
If we engage a new material subprocessor that processes customer personal data on behalf of Vahti, we will notify customers of the change at least 30 days before the change takes effect, unless the change is urgent for security, availability, or legal reasons.
The Customer may object to a new subprocessor on justified data protection grounds as described in Vahti’s Data Processing Agreement.
Other Privacy Documents
More information about the processing of personal data is available in the following documents:
Questions
Questions about subprocessors can be sent to:
Privacy contact:
Teemu Tapper
teemu@vahti.ai