Legal
Data Processing & Sub-Processors
Last updated: April 24, 2026
1. Overview
AIRA processes customer data to deliver AI governance assessments. The sub-processors listed below may receive customer data in the course of providing AIRA's services. Each sub-processor operates under its own Data Processing Agreement, linked in the table.
This page lists AI model and inference sub-processors. Hosting, email, SMS, and payments sub-processors are disclosed in full within AIRA's Data Processing Agreement, available on request.
2. AI Sub-Processors
| Sub-Processor | Purpose | Processing Location | DPA |
|---|---|---|---|
| Anthropic | Provider of Claude family of large language models via API. Used for conversational AI, document analysis, code generation, and compliance reasoning tasks. | United States (AWS us-east-1, us-west-2) | View → |
| AWS Bedrock | Amazon Web Services managed AI service providing access to foundation models from Anthropic, Meta, Mistral, AI21, Cohere, and Amazon Titan via unified API. | Configurable per AWS region (including ap-southeast-1 Singapore) | View → |
| Google (Gemini / Vertex AI) | Provider of Gemini family of multimodal models via Google AI API and Vertex AI. Supports text, image, video, and audio processing. | United States and European Union (Google Cloud regional selection) | View → |
| Microsoft Azure AI | Provider of Azure OpenAI Service, Azure AI Services (Vision, Speech, Language), and Azure Machine Learning. Enterprise AI platform with strong data residency and compliance controls. | Configurable per region (including Southeast Asia, Philippines proximity via Singapore/Japan regions) | View → |
| OpenAI | Provider of GPT-4, GPT-4o, and o-series models via API. Used for text generation, embeddings, function calling, and vision tasks. | United States (Microsoft Azure infrastructure) | View → |
3. AIRA's Data Processing Agreement
AIRA's Data Processing Agreement is available on request for enterprise customers. It includes the full sub-processor list (including hosting, email, SMS, and payment sub-processors), processing instructions, security controls, breach notification procedures, and data subject rights handling.
To request the DPA, email care@tavaraholdings.com with your organization's name and procurement contact.
4. Record of Processing Activities (ROPA)
AIRA maintains a Record of Processing Activities consistent with GDPR Article 30 and NPC DPA IRR §26. The ROPA is available under signed NDA for enterprise customers and regulators conducting authorized reviews.
5. Updates to This Page
Sub-processor additions or changes will be reflected on this page before taking effect. Customers with active subscriptions are notified by email at least 30 days in advance of any material sub-processor change.
6. Contact
For privacy, data processing, or sub-processor questions: care@tavaraholdings.com