Sub-Processors
Last Updated: April 8, 2026
This document is only available in English.
Delph-AI uses the following third-party service providers (sub-processors) to operate the Service. We have entered into, or are in the process of entering into, Data Processing Agreements (DPAs) with all sub-processors listed below.
We will update this page when we add or change sub-processors. If you wish to be notified of changes, please contact privacy@delph-ai.org.
AI Model Providers
These sub-processors process bibliographic data (titles and abstracts only) to perform AI-powered screening evaluations. No personal data (name, email, account information) is sent to AI model providers.
| Provider | Purpose | Data Processed | Location | Transfer Mechanism | DPA |
|---|---|---|---|---|---|
| Google (Vertex AI) | AI model inference (Gemini, MedGemma, Llama, Qwen, DeepSeek) | Titles, abstracts, criteria | EU (Belgium) | Adequate jurisdiction (EU) | Cloud Data Processing Addendum |
| OpenAI | AI model inference (GPT-4o, GPT-4.1, GPT-4o-mini, GPT-4.1 nano) | Titles, abstracts, criteria | US (EU data residency available) | SCCs + DPF | Data Processing Addendum |
| Anthropic | AI model inference (Claude Sonnet, Claude Haiku) | Titles, abstracts, criteria | US (EU routing) | SCCs | Commercial Terms DPA |
| Mistral | AI model inference (Mistral Large, Mistral Small) | Titles, abstracts, criteria | EU (Paris, France) | Adequate jurisdiction (EU) | Data Processing Addendum |
| xAI | AI model inference (Grok) | Titles, abstracts, criteria | US (EU endpoint available) | SCCs | Data Processing Addendum |
Note on Vertex AI: Google Vertex AI acts as a unified gateway for partner models (Llama, Qwen, DeepSeek). When these models are accessed through Vertex AI, data is processed within Google's infrastructure and covered by Google's Cloud Data Processing Addendum. Data is not sent to the original model providers (Meta, Alibaba, DeepSeek).
No training: Our agreements with AI providers prohibit the use of API inputs and outputs for training or improving their models. We verify this through each provider's published data processing terms.
Infrastructure and Services
| Provider | Purpose | Data Processed | Location | Transfer Mechanism | DPA |
|---|---|---|---|---|---|
| Google Cloud Platform | Hosting (Cloud Run, Cloud SQL), storage | All service data | EU (Belgium — europe-west1) | Adequate jurisdiction (EU) | Cloud Data Processing Addendum |
| Firebase (Google) | User authentication | Firebase UID, email, auth tokens | US | SCCs + DPF | Firebase Data Processing Terms |
| Stripe | Payment processing | Payment method tokens (pm_xxx), billing info | US / EU | DPF (certified) + SCCs | Data Processing Agreement |
| Resend | Transactional email delivery | Email address, email content | US | SCCs | Data Processing Agreement |
Transfer Mechanisms Explained
| Mechanism | Description |
|---|---|
| SCCs | Standard Contractual Clauses — legal contracts approved by the European Commission (Implementing Decision 2021/914) that ensure adequate data protection when transferring data outside the EEA |
| DPF | EU-US Data Privacy Framework — a framework that allows certified US companies to receive personal data from the EEA based on an adequacy decision by the European Commission |
| Adequate jurisdiction | The sub-processor is located in a country or region recognized by the European Commission as providing an adequate level of data protection (e.g., EU member states) |
Changes to This List
We review our sub-processors regularly. When we add a new sub-processor or make a material change, we will:
- Update this page with the new sub-processor's details;
- Note the date of the change;
- Notify users who have requested change notifications via email.
If you have concerns about a new sub-processor, please contact us at privacy@delph-ai.org.
Contact
For questions about our sub-processors or data processing practices:
- Privacy: privacy@delph-ai.org
- Security: security@delph-ai.org