Valutare Subprocessor List

How to read this list: anything marked Being built is not yet in the product; everything else describes what is in place today.

1. Purpose and change notification

Valutare, Inc. ("Valutare") engages a limited set of third-party service providers ("subprocessors") to deliver the Valutare performance-management platform. This register lists each subprocessor, the service it provides, the categories of customer personal data it may process, its processing location, and the transfer mechanism relied upon. It is incorporated by reference into the Valutare Data Processing Agreement ("DPA") as Annex III.

Subprocessors fall into two classes:

• Infrastructure subprocessors (Section 2) — engaged for all customers as part of operating the platform.
• Integration subprocessors (Section 3) — engaged only when a customer administrator or individual user connects the corresponding integration.

Change notification. Valutare will give at least 30 days' advance notice (by email to the customer's designated contact) before engaging a new subprocessor or materially expanding the scope of an existing one. During the notice period, customers may object as provided in the DPA. Removals and non-material updates (e.g., a vendor name change) may be reflected without advance notice.

2. Infrastructure subprocessors

How long AI providers keep requests. Providers may keep requests for a limited period to monitor abuse. None may use them for training. Periods are from each provider's published terms (checked October 14, 2026).

Note on Slack. The Slack row above covers Valutare's own operational alerting channel — it applies to all customers and is unrelated to the customer-optional Slack integration listed in Section 3, which processes customer workspace data only if a customer connects it.

Customer data is hosted in the United States. EU hosting will be offered to EU customers once EU data storage, AI processing in the EU and an EU data protection officer are in place. Being built: a separate instance (its own service and database) for each customer. Today, Google's Gemini API handles every AI request; once Anthropic and Mistral AI are in use, which AI provider handles a request depends on the feature and the language. Every AI provider is engaged under terms that bar training on customer data. Where customer personal data crosses a border to a subprocessor, transfers are governed by the mechanism recorded per vendor above. Google Cloud Platform and Google's AI services operate under Google's published Cloud Data Processing Addendum (which incorporates Standard Contractual Clauses); for vendors marked "execution in progress," the data-processing terms — which will incorporate SCCs — are being finalized.

3. Integration subprocessors (active only on customer connection)

The providers below process customer data only if a customer connects the corresponding integration. Each user connects their own work account (the customer's IT administrator may need to approve Valutare first); once Slack approves Valutare, Slack is installed once by the customer's Slack administrator and each user then links their account. Access is read-only metadata: who, when and with whom. Valutare never stores or uses email bodies, message text, file contents, recordings or transcripts; where a provider includes message text with the details Valutare uses, Valutare discards it on receipt. Valutare never sends email or messages as a user, and posts its own notifications only where the customer's administrator sets it up. Disconnecting an integration stops collection and deletes its stored data within 30 days. Being built: deletion of all Slack data within 14 business days after Valutare is removed from a Slack workspace.

HR, payroll and equity systems (connected by the customer's administrator):

Instead of connecting an HR system, a customer can upload a spreadsheet of its people.

Planned connections (not active; no data flows to them today). "Coming next" means built and waiting for the provider's approval, or next in line to build; "On our roadmap" means intended but further out. Each follows the rules in Section 3 and the privacy policy from the day it is offered. Customers are told under Section 1 before any of them handles customer data.

Single sign-on. Customers can sign in to Valutare through OpenID Connect with Okta, Microsoft Entra ID or Google. These sign-in services are the customer's own, not Valutare subprocessors.

Company-wide connection by a customer's IT administrator, where a provider approves it, may be offered later; customers will be told under Section 1 before it is available.

4. Website and sales vendors (no customer data)

These vendors run our public website (www.valutare.ai), our trust center and our sales contacts. They receive information about website visitors and people who contact us, never the employee data customers put in the Service. They are listed here because our privacy policy points to this page.

5. Vendors that are NOT active subprocessors

For transparency: the following vendors appear in Valutare's technology stack but are not subprocessors — no customer data is transmitted to them today.

If any of these services is activated in the future, customers will be notified under Section 1 before it processes customer data.

Two further clarifications privacy reviewers commonly ask about:

• Virus scanning of uploaded files runs on software self-hosted within Valutare's own infrastructure; no third party is involved.
• Valutare uses no payment processor and no third-party product-analytics vendor that processes customer data.
• Services that receive no customer content: Have I Been Pwned (checks a new password against known breaches using only the first 5 characters of a one-way hash of it), the push-notification services of users' browsers (notifications are encrypted and carry only a generic notice; the content is shown in Valutare after the user signs in), and public domain-registration lookups.