Sub-processor List

This page fulfils RadMah AI's sub-processor disclosure obligation under Article 28(2) of the General Data Protection Regulation (GDPR) and equivalent requirements under UK GDPR, Swiss revFADP, and other applicable data protection laws. A "sub-processor" is a third-party organisation that RadMah AI engages to process personal data on your behalf in the course of delivering the RadMah AI platform and services. RadMah AI remains your primary data processor and is responsible for ensuring that all sub-processors provide sufficient guarantees regarding their technical and organisational security measures. Each sub-processor listed below is engaged under a written data processing agreement that imposes obligations consistent with GDPR Article 28(3) and, where applicable, EU Standard Contractual Clauses or equivalent transfer mechanisms.

The table below lists the sub-processors currently authorised to process personal data in connection with the RadMah platform. It is maintained against the deployed estate; if you believe a processor is missing, tell us at privacy@radmah.ai and we will correct the register.

Model-inference sub-processors (OpenAI, Anthropic and Google) are engaged only when: (a) The customer uses the platform-managed AI key (the default configuration); and (b) The AI Orchestrator or Agentic Data Scientist feature is invoked. These sub-processors are NOT engaged when: — The customer configures a bring-your-own (BYO) API key. In this case, the customer's prompts are transmitted directly from RadMah AI's API layer to the customer's own AI provider account, under the customer's own agreement with that provider. RadMah AI does not act as a processor for BYO key AI calls. — The customer uses only deterministic generation stages in Synthesis, Virtual SCADA, ICS Security, or Virtual PLC without invoking AI Orchestrator, Fabricate contract-authoring, or Agentic Data Scientist features. What is transmitted is listed in the register above. Full Reference Datasets and Generated Outputs are never sent to a model provider. Where an agent step has queried a connected data source, a small preview of rows from that source may be included in the prompt — so if a connected source contains personal data, a sample of it can reach the model provider. We do not claim to strip personal data from prompts: if that matters for your use, disable live model calls or register your own provider key.

RadMah AI will notify all registered customers of any intended addition, replacement, or removal of a sub-processor at least 30 days before the change takes effect. Notification will be made by: (a) Email to the primary Account email address; and (b) An update to this page at www.radmah.ai/legal/subprocessors Enterprise customers subject to a Data Processing Addendum (DPA) that requires prior written consent for sub-processor changes may object to a new sub-processor within 30 days of notification in accordance with the procedure set out in the DPA. If a reasonable objection cannot be resolved, the customer may terminate the affected Services without penalty in accordance with the DPA termination-for-cause provisions. Changes required to comply with legal obligations or to remediate a security incident may be made with shorter or no advance notice; RadMah AI will provide notice as soon as reasonably practicable in such cases.

The sub-processors listed above are located primarily in the United States. Transfers of personal data from the EEA, UK, or Switzerland to these sub-processors are made under appropriate safeguards: EU to USA: EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), as incorporated into RadMah AI's Data Processing Addendum and the sub-processor's own DPA terms. UK to USA: UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs, as applicable. Switzerland to USA: Equivalent SCCs consistent with the Swiss Federal Act on Data Protection (revFADP). Enterprise customers who require data residency outside the USA should contact their Account Manager to discuss available configuration options. Selecting the European Union residency region keeps platform data in the EU. Control-plane processing by the sub-processors above may still involve a transfer to the United States, which is why these safeguards remain in place. Transfer-mechanism documentation is available on request: privacy@radmah.ai

RadMah AI conducts due diligence on all sub-processors before engagement and on a periodic basis thereafter. This includes: — Review of the sub-processor's data processing terms and security documentation — Verification of relevant certifications (e.g., ISO 27001, SOC 2 Type II, PCI-DSS) where applicable — Contractual requirements for security incident notification, audit rights, and data deletion RadMah AI does not engage sub-processors that cannot demonstrate adequate security measures consistent with the risks involved in processing the relevant personal data.

Sub-processor and GDPR inquiries: privacy@radmah.ai DPA and enterprise data processing terms: legal@radmah.ai RadMah AI will respond to all sub-processor enquiries within 10 business days.