Subprocessors
Vahti uses selected subprocessors to provide services such as infrastructure, payments, email delivery and customer communications. We publish an up-to-date list of subprocessors and update it as necessary. We will endeavour to notify customers of significant new subprocessors at least 30 days in advance.
Updated 23.4.2026
Subprocessors
Last updated: 24 April 2026
This page explains which subprocessors Vahti Service Oy uses to provide the vahti.ai service.
A subprocessor means a service provider that processes personal data on behalf of Vahti Service Oy, for example in connection with the technical operation of the service, billing, email delivery or customer communications.
Not all providers listed below process actual service data obtained from a customer’s Microsoft 365 environment. Some providers primarily process Vahti’s own customer relationship, billing, communication or website data.
| Service provider | Purpose | Nature of data processed | Location / data residency | Additional information |
|---|---|---|---|---|
| Google Cloud / Google Cloud EMEA Limited | Infrastructure, hosting, database, logging and technical operation of the service. In addition, Google Vertex AI / Gemini may process data to explain findings and produce guidance. | Customer company and user account data, technical service data, log data and data derived from the Microsoft 365 environment that is necessary for the operation of the service. | Vahti’s main production infrastructure is located in the EU, primarily in the europe-north1 region. Vertex AI / Gemini is configured to be used in the EU. | Vahti’s contracting entity for Google Cloud is Google Cloud EMEA Limited. |
| Stripe / Stripe Payments Europe, Limited and Stripe Technology Europe, Limited | Payments, subscriptions, billing and payment transaction processing. | Customer company billing details, contact person details, payment transaction details, subscription and payment status data, and technical identifiers relating to the payment method. | Stripe operates in the EEA through Irish Stripe entities, but the service may involve processing of or access to data outside the EU/EEA. | Stripe does not generally process the customer’s Microsoft 365 tenant data. Transfers are based on mechanisms under Stripe’s DPA, such as the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. |
| Postmark / AC PM, LLC | Email delivery, such as system messages, invitations, notifications and other messages necessary for use of the service. | Recipient email address, name, company, message content, sending and delivery logs, and technical message metadata. | United States / possible processing outside the EU/EEA. | Postmark is not used for payment processing or as the primary storage location for customer data. Transfers are based on mechanisms under Postmark’s DPA, such as the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. |
| HubSpot / HubSpot Ireland Limited | Website forms, leads and demo requests, CRM, sales and customer communications. | Contact person’s name, email address, phone number, title, company, enquiry content, data relating to the customer relationship and sales process, and technical data relating to the website and forms. | The HubSpot account is in the EU1 environment. HubSpot’s service may still involve processing of or access to data outside the EU/EEA. | HubSpot primarily processes website, sales and customer relationship data, not actual Microsoft 365 tenant data. Transfers are based on mechanisms under HubSpot’s DPA, such as EU Standard Contractual Clauses and/or other applicable transfer mechanisms. |
Changes to Subprocessors
Vahti Service Oy may update this list if the subprocessors used to provide the service change.
If we engage a new material subprocessor that processes customer personal data on behalf of Vahti, we aim to notify customers at least 30 days before the change takes effect, unless the change is urgent for reasons such as security, availability or legal requirements.
The Customer may raise a reasoned data protection objection to a new subprocessor as described in Vahti’s Data Processing Agreement.
Other Privacy Documents
More information about the processing of personal data is available in:
Questions
Questions about subprocessors can be sent to:
Contact person for data protection matters:
Teemu Tapper
teemu@vahti.ai