Sub-processors
Last updated: 15 July 2026
Vergil AI Hungary Kft. ("Vergil", "we", "us") uses the sub-processors listed below to provide, secure and operate the Vergil website and platform.
Personal data is not intentionally sent to the artificial-intelligence service providers listed below. They are nevertheless included for transparency and to cover circumstances in which user-uploaded documents or free-text inputs may contain personal data. Where processing may take place outside the European Union, Vergil uses the safeguards described in the table.
| Sub-processor | Processing location | Purpose | Transfer outside the EU | Safeguards and data-use restrictions |
|---|---|---|---|---|
| Hetzner Online GmbH | Nuremberg and Falkenstein, Germany (EU) | Platform hosting, infrastructure and S3-compatible object storage | No | Personal data is hosted within the EU. |
| Google Cloud (reCAPTCHA) | Google Cloud infrastructure, including possible processing outside the EU | Security, fraud prevention and automated-abuse detection for contact and waitlist forms. Processes technical, device and interaction signals and returns a verification token and risk score. | Yes, where processing or support takes place outside the EU | Google Cloud Data Processing Addendum; European Commission Standard Contractual Clauses where applicable; reCAPTCHA customer data is processed for security, threat detection, protection and service maintenance. |
| Google Ireland Limited (Google Analytics) | Google infrastructure, including possible processing outside the EU | Optional analytics for the public Site after visitor consent. Processes page and referral information, device and browser characteristics, approximate location, language choice and selected Site events. Form-field contents are not sent. | Yes, where processing or support takes place outside the EU | Google Ads Data Processing Terms; European Commission Standard Contractual Clauses where applicable. Analytics is consent-gated; Google Signals, advertising personalisation and remarketing are disabled. |
| Stripe Payments Europe, Ltd. | Ireland (EU), with support and anti-fraud processing by Stripe, Inc. in the United States | Payment processing, billing, subscription management and fraud prevention. Receives the billing contact and payment details of paying customers. | Yes, where processing is carried out by Stripe, Inc. | Data processing agreement incorporating the European Commission's Standard Contractual Clauses. Stripe acts as an independent controller for fraud prevention and for its own regulatory and compliance obligations. |
| Anthropic PBC | United States | Large-language-model processing for course generation and for preparing scripts used in narrated presentations. Personal data is not intended to be submitted. | Yes, where personal data is contained in submitted content | Data processing agreement incorporating the European Commission's Standard Contractual Clauses; zero-day data retention; submitted data is not used to train models. |
| OpenAI | United States | Large-language-model processing for responses generated by the Ziggy AI assistant. The service receives learner interaction content and generated lesson content without learner identifiers; personal data is not intended to be submitted. | Yes, where personal data is contained in submitted content | Data processing agreement incorporating the European Commission's Standard Contractual Clauses; zero-day data retention; submitted data is not used to train models. |
| Cartesia, Inc. | United States | Voice synthesis for narrated presentations. Input is limited to the generated narration script. | Yes, where personal data is contained in the generated script | Data processing agreement incorporating the European Commission's Standard Contractual Clauses; zero-day data retention; submitted data is not used to train models. |
Other infrastructure providers
For transparency, Vergil also uses the following providers in roles that, under the platform's current technical configuration, do not involve processing personal data on Vergil's behalf and therefore are not listed as sub-processors:
- Amazon Web Services EMEA SARL provides encryption key management through AWS KMS in the
eu-central-1(Frankfurt, EU) region. The key-management service does not have access to the encrypted platform data. - Cloudflare, Inc. provides DNS services only. Platform traffic is not proxied through Cloudflare, and Cloudflare does not process personal data for the platform in this role.
Vergil will update this page if the identity or role of its sub-processors changes.