Overview
anycast.io UG (haftungsbeschränkt) uses the subprocessors and technical service providers listed below to operate 2342.ai. This list is Annex B of the Data Processing Agreement and is versioned like it: for an organization, the version pinned by fingerprint at acceptance applies and stays available at its versioned address. Changes are announced to organization owners and admins by email before they take effect.
GLM 5.3 and GLM 5.3 Flash run on the EU data path through in-region routing to EU endpoints with zero data retention. GLM 5.2 and the Mistral route for GLM are external data paths with a training reservation and are locked by default. Which providers process a given model and under which retention and training terms is stated in the model datasheet (Annex C) at https://2342.ai/en/model-datasheet.
AI model providers (inference)
Depending on the selected model and data path, requests are processed through the following providers. For each provider the contractual basis is named, and for providers established outside the EU the transfer basis under Chapter V GDPR.
- Microsoft Ireland Operations Limited, Dublin, Ireland — ChatGPT models and text embeddings through Azure OpenAI in the EU Data Zone, and image generation and text to speech for ad videos in EU regions; no training on inputs and outputs, abuse monitoring with storage of up to 30 days within the EU — Microsoft Products and Services Data Protection Addendum; processing in the EU
- Amazon Web Services EMEA SARL, Luxembourg — Claude models through Amazon Bedrock in the regions eu-central-1, eu-west-1 and eu-north-1; no storage of inputs and outputs, no training — AWS GDPR Data Processing Addendum; processing in the EU
- Google Cloud EMEA Limited, Dublin, Ireland — Gemini models through Vertex AI in EU regions, and video generation for ad videos; no training on inputs and outputs — Google Cloud Data Processing Addendum; processing in the EU
- OpenRouter, Inc., USA — routing of requests exclusively to zero-data-retention endpoints; EU data path through the EU domain with in-region routing and processing only in the EU (including GLM 5.3 and GLM 5.3 Flash), models labeled external through global routing — OpenRouter Data Processing Agreement with EU Standard Contractual Clauses (Module 2, Implementing Decision (EU) 2021/914); no EU-U.S. Data Privacy Framework certification; transfer impact assessment documented: as a router, OpenRouter does not persistently store content
- Mistral AI, Paris, France — GLM 5.2 and GLM through the European endpoint (EU/EFTA) as an external data path; Public Preview with a training reservation, no zero-data-retention commitment; only after the organization enables it — Mistral Data Processing Agreement
- orgn.dev, inc., USA (BlackBit VOID) — zero-data-retention inference for external pentesting and abliterated models; processing in Norway, Iceland and the United States; external data path only after the organization enables it and not intended for personal data — EU Standard Contractual Clauses with the provider are being finalized; until then this data path is released exclusively for content without personal data
- Features & Labels, Inc. (fal.ai), San Francisco, USA — video generation (Seedance) for ad videos as an external data path, only after the organization enables it; only AI-generated images and scene descriptions written by the model are transmitted, automatically checked for personal data before sending, no account or user data — fal Data Processing Addendum with EU Standard Contractual Clauses (Module 2, Implementing Decision (EU) 2021/914); processing in the USA
- Eleven Labs Inc., New York, USA — text to speech with quality voices for ad videos as an external data path, only after the organization enables it; only the spoken text is transmitted, automatically checked for personal data before sending, no account or user data — ElevenLabs Data Processing Addendum with EU Standard Contractual Clauses (Module 2) and certification under the EU-U.S. Data Privacy Framework; processing in the USA
Changes and right to object
Intended additions or replacements of subprocessors are announced by email to the owners and admins of every organization with a DPA before they take effect and published as a new version of this list. The customer may object to the change for compelling data-protection reasons; if no agreement is reached, the customer has the special termination right under section 5 of the DPA. Until the change takes effect, the accepted version remains authoritative.
The Data Processing Agreement is available at https://2342.ai/en/dpa, the model datasheet at https://2342.ai/en/model-datasheet.
