Subprocessors
Last updated: August 12, 2026
Eridian is a product of RENEDOR LLC. These documents are the current published policies for Eridian, operated by RENEDOR LLC. Viewing this page does not create an order form, DPA, or other contract. Send legal and data-subject requests to the addresses listed in each document.
1. Purpose of This List
Eridian is a product of RENEDOR LLC. Eridian is operated by RENEDOR LLC, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates. This page lists third-party subprocessors that RENEDOR LLC engages to process Customer Personal Data in connection with the Service, as described in the Data Processing Addendum at /legal/dpa.
A subprocessor is a vendor that processes personal data on the Company's instructions in order to provide the Service. Hosted model providers appear when Customer selects GPT or Gemini. A provider URL Customer operates (local, private, or bare metal) is Customer's system and is not a Company subprocessor. Infrastructure and operations vendors run regardless of model choice, except where an Order Form states otherwise.
2. Current Subprocessors
The following entities are authorized subprocessors as of the date above. Regions indicate primary processing locations. Traffic may transit other locations on the provider's network for resilience and routing. Hosted production inference families are GPT (OpenAI) and Gemini (Google).
Google Analytics processes public-website visitor data when the visitor consents. That is separate from Customer workspace data processed for the Service.
| Entity | Role | Processing activities | Primary processing regions |
|---|---|---|---|
| Amazon Web Services, Inc. | Infrastructure processor | Cloud hosting, object storage, compute, managed databases, and key management for the Service, including Customer-selected data residency regions | United Arab Emirates, European Union, United States, Asia-Pacific |
| Vercel Inc. | Application hosting processor | Delivery of the Eridian web application, edge network, build pipeline, and deployment infrastructure | United States, European Union |
| Stripe, Inc. and Stripe Payments Europe, Limited | Payment processor | Subscription billing, invoicing, payment-method tokenization, and related tax/receipt records | United States, European Economic Area |
| OpenAI, LLC | Model inference processor | Large language model inference on prompts, context, and completions when Customer selects an OpenAI model | United States |
| Google LLC | Model inference and optional cloud processor | Gemini and related model inference when selected; optional Google Cloud resources if Customer enables them | United States, European Union |
| Google LLC (Google Analytics) | Website measurement processor | Aggregate traffic and usage measurement on the public Eridian website when the visitor consents to analytics cookies | United States |
| Cloudflare, Inc. | Network and security processor | Content delivery, DNS, DDoS protection, and web application firewall for the Service | Global anycast network |
| Functional Software, Inc. (Sentry) | Application monitoring processor | Error, performance, and release telemetry for the Service. Prompt content is not sent for monitoring except to the extent a fault payload unavoidably includes a fragment | United States |
| Vanta Inc. | Security and compliance processor | Trust-center hosting, control monitoring, and vendor security questionnaire support for RENEDOR LLC | United States |
| Twilio Inc. (SendGrid) | Communications processor | Transactional email for service notices, billing, security alerts, and account administration | United States |
3. Thirty-Day Notice of Changes
The Company will give at least thirty (30) days' prior notice before adding or replacing a subprocessor that will process Customer Personal Data, by updating this page and emailing workspace administrators. Emergency replacement of a subprocessor to address a security incident, outage, or legal requirement may occur with shorter notice; the Company will notify Customer as soon as practicable and the objection process below will apply from the date of notice.
Customer may object to a new subprocessor on reasonable data-protection grounds within fifteen (15) days of notice. If the parties cannot agree on a workaround, Customer may terminate the affected Service as set out in the DPA and receive a refund of prepaid unused fees for that portion.
4. Data Residency and Model Routing
Customer may pin Customer Data at rest to a region offered in the Service (United Arab Emirates, European Union, United States, or Asia-Pacific). Pinning does not prevent inference from occurring in the selected model provider's region. To keep inference in a specific region, Customer must select a model and configuration that the documentation marks as available in that region.
The Company does not permit subprocessors to use Customer Personal Data to train foundation models except with Customer's prior written consent.
A provider URL Customer operates is Customer's system. The Company does not run those GPUs and does not list that endpoint as a subprocessor.
5. Diligence
Before engaging a subprocessor, the Company reviews security documentation, executes a written data-processing contract, and assesses transfer mechanisms where personal data will leave the UAE, EEA, or UK. Diligence records are available to Enterprise customers under NDA as part of a security review, not on this public page.
6. Contact
Subprocessor notices and objections: contact@geteridian.com with a copy to contact@geteridian.com. RENEDOR LLC, Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.