Trust Center
Vendors & Subprocessors
The canonical register of vendors and subprocessors that process customer data on Magif's behalf, with the role, purpose, data categories, region and transfer basis for each one.
Last updated: 21 September 2026
Vendor and subprocessor register
Magif uses a small set of vendors to run the platform. Each entry below states exactly what the vendor does for Magif, which data categories it handles, where processing takes place and, where relevant, the legal basis for transfers outside the European Union. Where a row's data categories map clearly to one side of the platform, chips mark whose data is involved: End user for your clients, Coach for you, Both for shared platform records.
Scaleway Generative APIs
Scaleway SAS
- Role
- Processor
- Purpose
- AI model inference for coaching agent conversations, using open-source models hosted by Scaleway (EU); voice transcription; embedding computation for knowledge bases and assistant memory. Zero data retention: prompts and outputs are not retained by the provider after processing.
- Data categories
- Conversation content, retrieved knowledge passages, voice audio for transcription, text passages for embeddingEnd userCoach
- Transfer basis
- Not applicable (EU processing)
- Added to register
- 20 September 2026
AWS (EU AI services)
Amazon Web Services EMEA SARL
- Role
- Processor
- Purpose
- Creator assistant inference and media analysis (Bedrock, Paris eu-west-3) and speech synthesis (Polly, Paris eu-west-3). Bedrock prompts and outputs are not retained by the provider after processing.
- Data categories
- Creator assistant conversations, media submitted for analysis, text for speech synthesisCoach
- Transfer basis
- Not applicable (EU processing)
- Added to register
- 20 September 2026
AWS (UK storage & email)
Amazon Web Services EMEA SARL
- Role
- Processor
- Purpose
- File storage (S3) and transactional email (SES), both in the London region. The AWS London region operates under the same data-protection rules as the EU: UK GDPR mirrors EU GDPR, the European Commission has granted the United Kingdom a formal adequacy decision, and AWS applies the same contractual data-protection terms (the AWS GDPR Data Processing Addendum) and the same security controls in London as in its EU regions. Magif is migrating the remaining UK-hosted components, file storage and transactional email, to EU regions, and the platform will run fully in the European Union by the end of September 2026.
- Data categories
- Uploaded files, generated media, email addresses, verification codesEnd userCoach
- Transfer basis
- UK adequacy decision
- Added to register
- 20 September 2026
MongoDB Atlas, hosted on AWS
MongoDB, Inc.
- Role
- Processor
- Purpose
- Managed primary database
- Data categories
- Accounts, agents, conversations, platform recordsEnd userCoach
- Transfer basis
- Not applicable (EU processing)
- Added to register
- 20 September 2026
Qdrant Cloud
Qdrant Solutions GmbH
- Role
- Processor
- Purpose
- Vector storage for knowledge-base retrieval
- Data categories
- Embedded creator knowledge-base content only. Participant conversations and agent memory are never indexed here.Coach
- Transfer basis
- Not applicable (EU processing)
- Added to register
- 20 September 2026
Redis Cloud
Redis Ltd.
- Role
- Processor
- Purpose
- Real-time message routing between application nodes
- Data categories
- Transient message routing dataEnd userCoach
- Transfer basis
- Not applicable (EU processing)
- Added to register
- 20 September 2026
Stripe payments
Stripe
- Role
- Independent controller (payments)
- Purpose
- Payment processing, subscription billing and invoicing
- Data categories
- Billing contact details, payment card data (held by Stripe)Both
- Transfer basis
- Standard Contractual Clauses
- Added to register
- 20 September 2026
Google AI APIs
Google Ireland Limited
- Role
- Optional service provider
- Purpose
- Image generation and web search synthesisUsed only for image generation and website analysis in the creator assistant. Receives only the specific prompts or queries generated for these features when they are used; it does not receive conversation transcripts. Paid API tier: Google does not use this content to train its models.
- Data categories
- Image generation prompts, web search queries
- Transfer basis
- EU-US Data Privacy Framework / Standard Contractual Clauses
- Added to register
- 20 September 2026
Twilio Verify
Twilio Inc.
- Role
- Processor (verification)
- Purpose
- Phone number verification
- Data categories
- Phone numbers, verification codes
- Transfer basis
- Standard Contractual Clauses
- Added to register
- 20 September 2026
PostHog Cloud EU
PostHog, Inc.
- Role
- Processor
- Purpose
- Product analytics
- Data categories
- Usage events, session analyticsEnd userCoach
- Transfer basis
- Not applicable (EU processing)
- Added to register
- 20 September 2026
Datadog (EU site)
Datadog, Inc.
- Role
- Processor
- Purpose
- Application logging, tracing and monitoring
- Data categories
- Application logs, performance tracesBoth
- Transfer basis
- Not applicable (EU processing)
- Added to register
- 20 September 2026
No-training basis, verified against each provider's policy
For the providers that handle agent content, we checked the no-training statement against the provider's own published policy. Each row links to the source. Providers whose no-training basis we cannot yet confirm are not listed here.
Verified 21 September 2026View the walkthroughHide the walkthrough
These are the processors that handle agent content in the architecture described across the Trust Center. Each no-training statement links to the provider’s own published policy. Providers whose no-training basis we cannot yet confirm are not listed here.
| Provider | No-training basis | Retention |
|---|---|---|
Scaleway Generative APIs Core coaching inference (EU) | Inputs and outputs are not collected, reused or used to train models. Zero data retention is the default. Scaleway Generative APIs, Data privacy | Zero by default. Request content may be held only temporarily to investigate abusive traffic. |
AWS Bedrock (eu-west-3) Assistant inference and media analysis (EU) | AWS does not store model input or output and does not use it to train models. Invocation logging is off by default. AWS, How Amazon Bedrock uses your data | None retained by default. |
Qdrant Cloud (Frankfurt) Vector store for creator knowledge-base content only | A vector database, not a model. It stores only the creator knowledge-base embeddings we send. Participant conversations and agent memory are never indexed, and there is no provider-side training. Qdrant Cloud | Under our control. Vectors are deleted when the knowledge base is deleted. |
MongoDB Atlas (Paris, eu-west-3) Primary database | MongoDB acts as a processor under its data processing agreement and does not use customer data to train models. Data is encrypted at rest and in transit. MongoDB Atlas, GDPR compliance | Under our control, governed by our retention policy. |
Datadog (EU site) Application logs, traces and monitoring | Datadog uses customer data only to provide and support the service, not to train its own models. Datadog, Privacy policy | Application logs expire after 15 days. |
Inputs and outputs are not collected, reused or used to train models. Zero data retention is the default.
Scaleway Generative APIs, Data privacyRetention. Zero by default. Request content may be held only temporarily to investigate abusive traffic.
AWS does not store model input or output and does not use it to train models. Invocation logging is off by default.
AWS, How Amazon Bedrock uses your dataRetention. None retained by default.
A vector database, not a model. It stores only the creator knowledge-base embeddings we send. Participant conversations and agent memory are never indexed, and there is no provider-side training.
Qdrant CloudRetention. Under our control. Vectors are deleted when the knowledge base is deleted.
MongoDB acts as a processor under its data processing agreement and does not use customer data to train models. Data is encrypted at rest and in transit.
MongoDB Atlas, GDPR complianceRetention. Under our control, governed by our retention policy.
Datadog uses customer data only to provide and support the service, not to train its own models.
Datadog, Privacy policyRetention. Application logs expire after 15 days.
Provider policies reviewed on 21 September 2026 from the official sources linked above. Providers whose no-training basis is not yet confirmed are excluded from this table.
Change history
Every change to the register is recorded here.
21 September 2026
Clarified the AWS London region for file storage and transactional email: it operates under the same data-protection rules as the EU (UK GDPR and a European Commission adequacy decision), and recorded the commitment to migrate these components to EU regions so the platform will run fully in the European Union by the end of September 2026.
20 September 2026
Initial publication of the subprocessor register.
Subscribe to updates
Leave an email address and we will notify you when this register changes.