Sub-processors
Last updated: 2 September 2026
This page lists the entities 404 AFK relies on to provide Raggli — the register the data processing agreement (DPA) points to. It is dated: any change updates the date below, and changes affecting the data covered by the DPA are notified by email at least 30 days in advance.
Register
One row per legal entity and per role — not per product: the hosting, storage, text-recognition, inference and email services Raggli uses all belong to Microsoft. Google Ireland Limited appears twice: once as a sub-processor (ranking documents and conversations in Vertex AI Search), once as an independent controller (sign-in with a Google account) — the two do not overlap.
| Entity | Role | Location | Transfer safeguards |
|---|---|---|---|
| Microsoft Ireland Operations Limited (Microsoft Azure) | Infrastructure and processing services: hosting, storage, text extraction, answer generation, transactional email delivery | European Union | Processing in the EU; Microsoft's standard contractual clauses as a backstop for support |
| Google Ireland Limited (Vertex AI Search) | Ranking of imported document excerpts and of the questions visitors ask — sub-processor within the meaning of the data processing agreement | European Union | Processing in the EU; Google's standard contractual clauses as a backstop for support |
| Stripe Payments Europe, Ltd | Subscription payment and invoicing, as Merchant of Record — independent controller | EU / United States | EU-U.S. Data Privacy Framework and standard contractual clauses |
| Google Ireland Limited | Sign-in with a Google account, only if the customer chooses that method — independent controller | EU / United States | EU-U.S. Data Privacy Framework and standard contractual clauses |
| Cloudflare, Inc. | Content delivery and filtering network in front of raggli.com and app.raggli.com: every request passes through it (IP address, request headers and metadata). Anti-bot verification on the sign-up form (Turnstile) — independent controller | EU / United States | EU-U.S. Data Privacy Framework and standard contractual clauses |
DPA scope
Microsoft Azure and Google (Vertex AI Search) process the uploaded documents and the visitors' conversations — the data for which 404 AFK acts as the customer's processor: they are the only two sub-processors within the meaning of the data processing agreement. On Google's side, only the text of document excerpts and the question asked ever transit — never the generated answer, nor any other account data.
Stripe and Google (this time for account sign-in) act as independent controllers, for payment and authentication respectively. Cloudflare acts in two capacities: anti-bot verification on the sign-up form, and the delivery network placed in front of the service, through which every request passes. None of the three falls under the data processing agreement; none has access to the documents or to the content of the conversations — Cloudflare carries the encrypted traffic and logs its metadata, it does not store it.
Prior notice and objection
Any addition or replacement of a sub-processor affecting the data covered by the DPA is notified to customers by email at least 30 days before it takes effect, on top of the dated update of this page.
Within that period, the customer may raise a reasoned objection under the conditions set out in the DPA; if no reasonable solution is found, they may terminate free of charge before the change takes effect.