Sub Processors

Requesty Ltd – Sub‑processor Disclosure

Last updated: 23 September 2025

Sub‑processors are third‑party businesses engaged by Requesty Ltd ("Requesty", "we", "our") to process Personal Data on our behalf while we provide services to our customers ("Controllers"). Under the UK GDPR and EU GDPR these companies must offer sufficient guarantees, via contract, to implement appropriate technical and organisational measures that meet the regulation's requirements.

This page explains (1) our governance approach and (2) the current list of sub‑processors we rely on for the Requesty Large‑Language‑Model Router and related pay‑as‑you‑go services.

1 Governance

Due‑diligence & risk assessment. Every prospective sub‑processor undergoes security, privacy and compliance reviews before onboarding. We examine certifications (e.g. ISO 27001, SOC 2), security white‑papers, audit reports and data‑protection controls.

Contractual safeguards. Each sub‑processor signs a data‑processing agreement with Requesty that:• mirrors or exceeds the obligations in our customer DPA;• includes a robust personal‑data‑breach notification provision; and• commits to suitable technical and organisational measures.

Ongoing monitoring. We conduct annual reviews and monitor security advisories, incident reports and regulatory developments affecting each sub‑processor.

Notification & objection. Customers are notified at least 30 days in advance of any intended change to this list (via email or in‑app banner). If you have reasonable grounds to object, email support@requesty.ai within the notice period.

2 Current Sub-processors

The tables below list our infrastructure provider and model‑inference providers. Unless stated otherwise, Personal Data is limited to that necessary to provide the indicated service and is encrypted in transit and at rest.

2.1 Infrastructure

2.2 Large‑Language‑Model Providers (Inference)

When routing is enabled, prompts and model outputs are transmitted securely to the selected provider, processed transiently, and not used to train the provider's models unless you have explicitly opted in via your Requesty project settings.