Sub-processors

The companies that process the data of the apps you host on smithable.ai, on our behalf. Which of them an app's data may reach depends on what you choose on the app's page: an EU app at one of three levels, Strict, Normal (a new app's level) or Relaxed, or a non-EU app.

Last changed 2026-10-14.

At every level

• Amazon Web Services: hosting, storage and backups, in Stockholm (eu-north-1).
• Scaleway: delivery of the mail your apps send, in the EU.
• Mistral AI, an EU company: your own AI requests in the builder and, when an app's users ask its assistant, that question and the records the app's tools return to the person asking. At Strict, the assistant uses Mistral Small, then Mistral Medium for a question Small cannot answer.

At Normal and Relaxed, and for a non-EU app, also

• Amazon Bedrock in EU regions: Anthropic's Claude models through Bedrock's EU inference profiles, for the builder's AI requests that use Claude and for the assistant's questions. At Normal the assistant uses Claude Haiku 4.5, with Mistral Medium while Bedrock is unavailable. Nothing is passed to Anthropic.

An app at Normal or Relaxed, or a non-EU app, uses Amazon Bedrock because of that choice, which you can change at any time. An EU app's data stays in the EU at every level. A non-EU app, which only an account outside the EU can have, may use AI models served anywhere; today it uses the same ones as Normal, and a new one would be added to this list first.

No training

No sub-processor trains AI models on your apps' data, at any level. Questions to an app's assistant are counted, never stored.

A new sub-processor

At least 30 days before a new sub-processor is used, we update this list and the privacy notice, and tell the customers it affects, those with a project at a level that uses it, by a notice in their overview and by email. If you object, you may end the service.

Not sub-processors

• The services your app calls through its Connections, and a mailbox you connect with Mail in, are yours: your app sends to or reads from them on your instruction. At Strict, only services run by EU companies are allowed, and you sign in with an email code rather than Google or Facebook.
• Google and Cloudflare do not process your apps' data for us.

Questions: legal@smithable.ai