Every third party that touches your data, named.
ArthurAI™ uses a deliberate, minimal set of subprocessors. Each is engaged under a contract that includes appropriate technical and organizational measures. Material changes to this list are disclosed under change-control with a notice period before the change takes effect for an institutional deployment.
Last updated May 17, 2026. To request the executable Data Processing Agreement or to object to a subprocessor change, talk to our team.
Microsoft Azure is the entire substrate. Every service below runs inside Azure under the same Microsoft Online Services Data Protection Addendum.
Microsoft Azure — Compute
East US (production), West US 2 (ULE)
Role. Static Web Apps, Container Apps, Azure Functions (queue + timer triggers)
Agreement. Microsoft Online Services DPA + Azure customer agreement (public reference: aka.ms/dpa)
Microsoft Azure — Storage
East US, West US 2; EU/Africa on request
Role. Blob Storage (tenant-scoped containers), Cosmos DB (Mongo API), Azure Database for PostgreSQL
Agreement. Microsoft Online Services DPA
Microsoft Azure — Security
East US (production)
Role. Key Vault (RBAC + soft delete + private endpoint), Bastion (admin access), NAT Gateway (egress), Front Door Premium + WAF
Agreement. Microsoft Online Services DPA
Microsoft Azure — Monitoring
East US, West US 2
Role. Application Insights (server + client telemetry), Log Analytics (operational logs)
Agreement. Microsoft Online Services DPA
Microsoft Azure — Messaging
East US
Role. Service Bus (async job queues for course generation, LCP summary, learning profile, email send)
Agreement. Microsoft Online Services DPA
Microsoft Azure — Networking
East US (production)
Role. Virtual Network with private endpoints for Key Vault, Cosmos, Functions; Private DNS zones
Agreement. Microsoft Online Services DPA
Microsoft Azure — Identity
Global Microsoft Entra
Role. Microsoft Entra ID for institutional federation, SSO, conditional-access integration
Agreement. Microsoft Online Services DPA
Microsoft Azure — Cognitive Services (Speech)
East US, West US 2
Role. Text-to-Speech with Azure Neural Voices for accessibility
Agreement. Microsoft Online Services DPA
The Eve-Education™ F5/reasoner architecture composes frontier and small models behind Azure-hosted endpoints. Where an institution or jurisdiction prohibits a specific provider, that provider is swapped without rebuilding the agent. Production routing today centers on OpenAI / Azure OpenAI for tutoring; the broader rotation is design-level and roadmap.
OpenAI, L.L.C.
OpenAI U.S. infrastructure (API tier — no training on inputs/outputs)
Role. GPT-4o, GPT-4o-mini, o1-mini for reasoning, generation, and vision (Responses API + Chat Completions)
Agreement. OpenAI API Enterprise Agreement (data not used for training)
Microsoft (Azure OpenAI Service)
Aligned to deployment region (East US production)
Role. Primary route for OpenAI-family models with Azure regional residency, enterprise governance
Agreement. Microsoft Online Services DPA + Azure OpenAI service-specific terms
Microsoft Azure AI Foundry — Llama family
Aligned to deployment region
Role. Llama-4-Maverick (general purpose default), Llama-3.2-90B-Vision (specialized vision) hosted in Azure
Agreement. Microsoft Azure AI Foundry terms (Meta model license honored under Azure hosting)
Microsoft Azure AI Foundry — Mistral
Aligned to deployment region
Role. Mistral-Large-3 for multilingual high-quality generation
Agreement. Microsoft Azure AI Foundry terms
Microsoft Azure AI Foundry — DeepSeek
Aligned to deployment region
Role. DeepSeek-R1 for complex reasoning paths
Agreement. Microsoft Azure AI Foundry terms
Microsoft (Phi family)
Aligned to deployment region
Role. Phi-4 for efficient multimodal classification and small-reasoner stages
Agreement. Microsoft Online Services DPA
Cohere
Aligned to deployment region (via Azure AI Foundry where applicable)
Role. embed-v-4-0 for text embeddings (semantic search, similarity)
Agreement. Cohere data-protection terms
Anthropic, PBC
Anthropic U.S. infrastructure (no training on inputs/outputs)
Role. Claude family (Opus, Sonnet, Haiku) — composed in F5 where institution allows; available where required for specific reasoning paths
Agreement. Anthropic Commercial Terms (data not used for training)
Transactional email and notification delivery.
Microsoft Communication Services
East US
Role. Transactional email (account notifications, password reset, certificate delivery, parental consent emails where applicable)
Agreement. Microsoft Online Services DPA
These subprocessors operate only on arthurgrid.ai. They never see institutional product data. Microsoft Clarity is opt-in via the CCPA-aligned consent banner.
Microsoft Clarity
Microsoft Clarity infrastructure
Role. Consent-gated visitor analytics on the marketing site only — aggregate session behavior, no audio, no keystroke logging, no cross-site tracking
Agreement. Microsoft Online Services DPA + consent gate enforced at runtime
Where applicable, institutional billing flows through one of two payment providers. ArthurAI™ stores billing metadata and subscription status; card data remains with the payment provider (PCI scope-minimized).
Stripe, Inc.
Stripe U.S. infrastructure
Role. Payment processing for institutional subscriptions; Stripe webhook ingestion for subscription state
Agreement. Stripe Services Agreement + Stripe DPA
Block, Inc. (Square)
Block U.S. infrastructure
Role. Alternative payment processor for institutional subscriptions where Stripe is not preferred
Agreement. Square Payment Processing Terms + Square DPA
Change control
Material changes to this list (adding a new subprocessor with access to institutional data, or replacing an existing one) trigger a written notice to institutional Data Protection Officers with a 30-day notice period. The institution may object during the notice period; objection paths are documented in the executed Data Processing Agreement.
See also: Data Processing Agreement · data handling · security FAQ.