Sub-processor List

This page fulfils RadMah AI's sub-processor disclosure obligation under Article 28(2) of the General Data Protection Regulation (GDPR) and equivalent requirements under UK GDPR, Swiss revFADP, and other applicable data protection laws. A "sub-processor" is a third-party organisation that RadMah AI engages to process personal data on your behalf in the course of delivering the RadMah AI platform and services. RadMah AI remains your primary data processor and is responsible for ensuring that all sub-processors provide sufficient guarantees regarding their technical and organisational security measures. Each sub-processor listed below is engaged under a written data processing agreement that imposes obligations consistent with GDPR Article 28(3) and, where applicable, EU Standard Contractual Clauses or equivalent transfer mechanisms.

The table below lists all sub-processors currently authorised by RadMah AI to process personal data in connection with the RadMah AI platform.

LLM inference sub-processors (OpenAI and Anthropic) are engaged only when: (a) The customer uses the platform-managed AI key (the default configuration); and (b) The AI Orchestrator or Agentic Data Scientist feature is invoked. These sub-processors are NOT engaged when: — The customer configures a bring-your-own (BYO) API key. In this case, the customer's prompts are transmitted directly from RadMah AI's API layer to the customer's own AI provider account, under the customer's own agreement with that provider. RadMah AI does not act as a processor for BYO key AI calls. — The customer uses only the core synthetic data generation capabilities (Synthesize, Mock Data, Constrained Synthesis, SCADA Simulator, ICS Attack Scenario Generator) without invoking AI Orchestrator features. RadMah AI applies prompt engineering controls to minimise the inclusion of personal data in LLM prompts. Reference Datasets submitted for generation are not transmitted to LLM providers.

RadMah AI will notify all registered customers of any intended addition, replacement, or removal of a sub-processor at least 30 days before the change takes effect. Notification will be made by: (a) Email to the primary Account email address; and (b) An update to this page at www.radmah.ai/legal/subprocessors Enterprise customers subject to a Data Processing Addendum (DPA) that requires prior written consent for sub-processor changes may object to a new sub-processor within 30 days of notification in accordance with the procedure set out in the DPA. If a reasonable objection cannot be resolved, the customer may terminate the affected Services without penalty in accordance with the DPA termination-for-cause provisions. Changes required to comply with legal obligations or to remediate a security incident may be made with shorter or no advance notice; RadMah AI will provide notice as soon as reasonably practicable in such cases.

The sub-processors listed above are located primarily in the United States. Transfers of personal data from the EEA, UK, or Switzerland to these sub-processors are made under appropriate safeguards: EU to USA: EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), as incorporated into RadMah AI's Data Processing Addendum and the sub-processor's own DPA terms. UK to USA: UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs, as applicable. Switzerland to USA: Equivalent SCCs consistent with the Swiss Federal Act on Data Protection (revFADP). Enterprise customers who require data residency outside the USA should contact their Account Manager to discuss available configuration options. Copies of applicable SCCs and transfer mechanism documentation are available on request: privacy@radmah.ai

RadMah AI conducts due diligence on all sub-processors before engagement and on a periodic basis thereafter. This includes: — Review of the sub-processor's data processing terms and security documentation — Verification of relevant certifications (e.g., ISO 27001, SOC 2 Type II, PCI-DSS) where applicable — Contractual requirements for security incident notification, audit rights, and data deletion RadMah AI does not engage sub-processors that cannot demonstrate adequate security measures consistent with the risks involved in processing the relevant personal data.

Sub-processor and GDPR inquiries: privacy@radmah.ai DPA and enterprise data processing terms: legal@radmah.ai RadMah AI will respond to all sub-processor enquiries within 10 business days.