Legal

Sub-processors

Technology providers that Monolitica uses to process personal data on behalf of a client, with processing country and transfer mechanism. The infrastructure we host runs in European Union regions. This list is binding under the Data Processing Agreement (DPA) and any change is communicated with advance notice.

Last updated: 21 August 2026

AI model providers

Model choice depends on the project and the client. Some systems are configured with the client's own API key or tenant, in which case this provider does not act as a sub-processor of Monolitica.

Provider	Service	Country	EEA Transfer	Mechanism	DPA
OpenAI, L.L.C.	GPT models via API, when the project uses them. Business terms (API Platform), no model training on client data.	USA, with EU data residency available under European Projects	No, when the project runs under European Projects; yes in all other cases	EU-US Data Privacy Framework and standard contractual clauses in the DPA; zero data retention (ZDR) when contracted	link
Anthropic PBC	Claude models via API, when the project uses them. Commercial terms, no model training on client data.	USA; EU hosting through Amazon Bedrock (eu-central-1) or Google Vertex AI, when the project requires it	Yes, except when deployed in an EU region	Standard contractual clauses in the DPA; zero data retention when contracted	link

Platform and infrastructure

Provider	Service	Country	EEA Transfer	Mechanism	DPA
Vercel Inc.	Hosting of the monolitica.pt corporate website and Vercel Web Analytics (aggregated traffic analysis, no cookies)	USA, with delivery and execution in EU regions	Yes, for administrative and support access from the USA	EU-US Data Privacy Framework and standard contractual clauses in the DPA	link
Railway Corporation	Hosting of the applications and services developed for clients, when run on the cloud managed by Monolitica	USA, with infrastructure in the europe-west4 region (Amsterdam, Netherlands)	Yes, for administrative and support access from the USA	Standard contractual clauses in the DPA; SOC 2 Type II	link
Neon Inc.	Managed PostgreSQL database for the systems developed	USA, with data stored in AWS eu-central-1 (Frankfurt)	Yes, for administrative and support access from the USA	EU-US Data Privacy Framework and standard contractual clauses in the DPA	link

Scheduling

Provider	Service	Country	EEA Transfer	Mechanism	DPA
Cal.com, Inc.	Scheduling of the initial meeting, through an external link to cal.com. Only processes the data the person enters in the booking form.	USA	Yes	EU-US Data Privacy Framework or standard contractual clauses, under Cal.com's privacy policy	link

Internal operations

Provider	Service	Country	EEA Transfer	Mechanism	DPA
Google LLC · Google Workspace	Email, calendar and document storage for internal operations and client collaboration	USA, with the Europe data region configured on covered services	Yes, for administrative and support access from the USA	EU-US Data Privacy Framework and standard contractual clauses in the Cloud Data Processing Addendum	link

Deployment models

The systems developed can run on the cloud managed by Monolitica, on the client's cloud, or on-premise. On the client's cloud or on-premise, the infrastructure providers are chosen and contracted by the client and do not appear on this list as sub-processors of Monolitica. On the managed cloud, the providers applicable to the project appear on the binding list agreed with the client.

Subscribe to changes

To receive automatic notifications of changes to this list, write to [email protected] with the subject “Subscribe to sub-processor changes”.