At a glance
- 10 Subprocessors: each listed with its processing purpose, data categories, and location.
- EEA-first: primary processing locations are in the EEA or Switzerland (adequacy decision); the only US-based Subprocessor (ElevenLabs) is optional and is never engaged where the Client has contracted EU data residency.
- Transfer mechanisms: transfers outside the EEA rely on European Commission adequacy decisions or the EU-U.S. Data Privacy Framework.
- Zero Data Retention: applies to prompts and outputs processed through the AI model services provided by Microsoft Azure and OpenAI.
- Third-Party Services: providers connected through an Integration are not Subprocessors and are not listed in this Register in that capacity.
This document forms part of the Data Processing Addendum, which is incorporated by reference into the Agreement under Clause 2.1(c) of the General Terms and Conditions. It is published at a stable public address, in a form allowing for its storage and reproduction.
§ 1Subprocessors
| Subprocessor | Purpose | Personal Data Processed (Functional Categories) | Primary Processing Location | Transfer Mechanism (if outside EEA) |
|---|---|---|---|---|
| Microsoft Azure¹ | Hosting, infrastructure and AI models | Identification and Access Data; Content-Associated Metadata; User Content | Switzerland; Sweden | Adequacy Decision² |
| AWS³ | Storage and infrastructure | User Content | Paris, France | N/A |
| Okta⁴ | Identity and access management | Identification and Access Data | Dublin, Ireland; Frankfurt, Germany | N/A |
| AssemblyAI⁵ | AI models | User Content | EU | N/A |
| PostHog⁶ | Product analytics | Identification and Access Data; Service Operations and Security Data; Content-Associated Metadata | Frankfurt, Germany | N/A |
| New Relic⁷ | Observability and monitoring | Service Operations and Security Data; Content-Associated Metadata | EU | N/A |
| OpenAI⁸ | AI models | Content-Associated Metadata; User Content | Switzerland | Adequacy Decision⁹ |
| Modal Labs | Compute and infrastructure | User Content | EU | N/A |
| Mistral AI¹⁰ | AI models | Content-Associated Metadata; User Content | Paris, France | N/A |
| ElevenLabs¹¹ | AI models | User Content | USA | EU-US Data Privacy Framework¹² |
§ 2Notes
¹ NeuralShift and Microsoft have a Data Processing Addendum in force between them, available at: https://www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(Portuguese%20(Portugal))(April2025)(CR).docx. Moreover, NeuralShift has been approved by Microsoft for modified abuse monitoring of its AI model services, under which prompts and outputs are not stored, thereby ensuring Zero Data Retention for that content.
² Switzerland benefits from an adequacy decision by the European Commission, which means that it offers a level of data protection considered equivalent to that of the EU.
³ NeuralShift and AWS have a Data Processing Addendum in force between them, available at: https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf.
⁴ NeuralShift and Okta have a Data Processing Addendum in force between them, available at: https://www.okta.com/sites/default/files/2025-01/DATA_PROCESSING_ADDENDUM.pdf.
⁵ NeuralShift and AssemblyAI have a Data Processing Addendum in force between them, available at: https://www.assemblyai.com/legal/data-processing-addendum#annex-a-to-dpa-description-of-processing.
⁶ NeuralShift and PostHog have a Data Processing Addendum in force between them, available at: https://posthog.com/dpa.
⁷ NeuralShift and New Relic have a Data Processing Addendum in force between them, available at: https://newrelic.com/termsandconditions/dataprotection.
⁸ NeuralShift and OpenAI have a Data Processing Addendum in force between them, together with an addendum regarding Zero Data Retention for the Personal Data processed (User Content, Content-Associated Metadata), available upon request.
⁹ Switzerland benefits from an adequacy decision by the European Commission, which means that it offers a level of data protection considered equivalent to that of the EU.
¹⁰ NeuralShift and Mistral AI have entered into a Data Processing Addendum, available at: https://legal.mistral.ai/terms/data-processing-addendum.
¹¹ NeuralShift and ElevenLabs have entered into a Data Processing Addendum, available at: https://elevenlabs.io/dpa. This Subprocessor is optional and is engaged only for Clients that do not require EU data residency. It is not engaged where the Client has contracted EU data residency, in which case no Personal Data are transferred to it.
¹² The international transfer of Personal Data is made under the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework (“DPF”). ElevenLabs’ certification is publicly available in the relevant official register at: https://www.dataprivacyframework.gov/list.
§ 3Third-Party Services
The providers of Third-Party Services connected to the Software through an Integration are not Subprocessors and are not listed in this Register in that capacity. Where an Output is transmitted to a Third-Party Service supplied under the Client’s own arrangements, that provider receives it either as a controller in its own right or as a processor of the Client, and does not process Personal Data on NeuralShift’s behalf. Where NeuralShift engages a provider to supply a component of an Integration, that provider is listed above. Where the same undertaking, or another undertaking of its group, is engaged by NeuralShift as a Subprocessor, it is listed above in that capacity alone.