Sub-processor Policy

This Sub-processor Policy provides transparency about the third parties ("sub-processors") that NEBULONS AI engages to support the delivery of the NEBULONS AI Studio platform, and describes the controls imposed on them. It is incorporated into the Data Processing Agreement and the Master Services Agreement.

NEBULONS AI deliberately keeps its sub-processor list minimal. The current engagement consists of a cloud infrastructure provider that hosts the isolated compute and storage environments used by the platform and its global content delivery network. A current list of sub-processors, including their role and processing location, is available to Customers on written request to NEBULONS AI support and is reviewed and updated as part of this policy.

Before engaging any sub-processor, NEBULONS AI performs a documented due diligence assessment covering the sub-processor's security certifications, data protection practices, incident response capability, and financial and operational stability. NEBULONS AI engages a sub-processor only where that assessment demonstrates the sub-processor can protect Customer Data to a standard equivalent to NEBULONS AI's own commitments.

Every sub-processor is bound by a written contract imposing data protection obligations materially equivalent to those NEBULONS AI owes its Customers under the Data Processing Agreement, including: processing only on documented instructions; confidentiality undertakings binding personnel; encryption in transit and at rest; assistance with data subject rights; breach notification to NEBULONS AI without undue delay; and the deletion or return of all data upon the end of the engagement. NEBULONS AI remains fully liable to the Customer for the acts and omissions of its sub-processors to the same extent as if performed by NEBULONS AI itself.

Sub-processors are contractually prohibited from using Customer Data for any purpose other than providing the contracted infrastructure service. The prohibition on training models on Customer Data, and the zero-retention requirement, apply to sub-processors to the same extent they apply to NEBULONS AI. Sub-processors may not engage further sub-processors ("fourth parties") for the processing of Customer Data without NEBULONS AI's prior written authorisation.

NEBULONS AI will notify Customers of any intended addition or replacement of a sub-processor that could affect the processing of Customer Data, in advance and in sufficient time for the Customer to object on reasonable data protection grounds. Where a Customer raises a substantiated objection, the parties will work in good faith to resolve it; failing resolution, the Customer may terminate the affected Services in accordance with the Master Services Agreement.

The security posture of each sub-processor is re-evaluated at least annually and after any material incident or architectural change affecting the sub-processor. Where a sub-processor fails to maintain the required standard, its engagement is remediated or terminated. Any data held by a sub-processor at the end of an engagement is deleted or returned under the same timelines and verification standards NEBULONS AI applies to its own systems.