We have a written data processing agreement with each sub-processor that requires confidentiality and appropriate technical and organizational safeguards. For transfers of personal data from the EEA, UK, or Switzerland to a third country, we rely on the European Commission's Standard Contractual Clauses, equivalent UK and Swiss mechanisms, or, where the sub-processor maintains certification, the EU-U.S. Data Privacy Framework.
We have configured our AI sub-processors so that data we send through their APIs is not used to train their general-purpose models.