Sub-processors & DPA
Last updated: 23 september 2026
To provide Team Two, Team Two AI AB uses the sub-processors below. Each is bound by a written agreement with data protection obligations at least as protective as our Data Processing Agreement (DPA).
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, databases, file storage, backups | EU (Stockholm, eu-north-1) | Data stored in the EU |
| Anthropic, PBC | Model inference for agent responses | United States | Standard Contractual Clauses |
| OpenAI | Model inference and document embeddings | United States | Standard Contractual Clauses / EU-US Data Privacy Framework |
| Brave Software, Inc. | Web search when an agent uses the web search tool | United States | Standard Contractual Clauses |
| SerpApi, LLC | Web search when an agent uses the web search tool | United States | Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Subscription billing and payments | EU (Ireland), with processing in the United States | Standard Contractual Clauses / EU-US Data Privacy Framework |
Services you connect yourself
Integrations you enable, such as Slack, Microsoft Teams, Notion, Jira, or your own Anthropic, OpenAI, or vLLM deployment, are not our sub-processors. Data sent to them is governed by your own agreement with that provider. Using local vLLM or your own keys lets you keep model inference within your own boundary.
Changes to this list
We update this page before a new sub-processor starts processing customer data and notify customer admins by email at least 30 days in advance. If you have a reasonable data protection objection, tell us at hello@tt2.ai within that period and we will work with you on a solution. If we cannot find one, you may terminate the affected service.
Data Processing Agreement summary
Roles: the customer is the controller of Customer Data and Team Two AI AB is the processor.
Instructions: we process Customer Data only to provide the service and on the customer's documented instructions.
Confidentiality and security: staff with access are bound by confidentiality, and we apply the technical and organizational measures described on our Security page.
Assistance: we help customers respond to data subject requests and with data protection impact assessments where relevant.
Breaches: we notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Data.
Deletion: at the end of the contract we return or delete Customer Data, as described in our Terms of Service.
Audits: we provide information needed to demonstrate compliance and allow reasonable audits on request.
The full DPA is available on request at hello@tt2.ai.