Trust center

Company registration · Data Processing Agreement · sub-processors · CLOUD Act exposure per route

1. Company

Operator

Carbonifer SAS, société par actions simplifiée (SAS) incorporated in France

SIREN

952 788 560 — public registry entry

EU VAT number

FR53952788560

Registered office

4 Rue Voltaire, 44000 Nantes, France

Contact

support@lowrouter.ai

Legal notice

Impressum · Terms of Service · Privacy Policy

2. Data Processing Agreement

For the content of the requests you send through the API, Carbonifer SAS acts as your processor under Article 28 GDPR. Our Data Processing Agreement covers the Article 28(3) obligations, incorporates the sub-processor list by reference and commits to 30 days notice before a sub-processor is added or materially changed.

Status: draft under legal review. The DPA has not yet been reviewed by counsel, so we do not publish it here as a signable document. It is available on request at support@lowrouter.ai, sent clearly marked as a draft. Once reviewed, the executable version will be published on this page.

3. Sub-processors

The platform is hosted by OVH SAS (OVHcloud), France (Gravelines). In all, 7 vendors help run the platform:

• OVH SAS (OVHcloud)
• Scaleway SAS
• Stripe Payments Europe, Ltd.
• Termly, Inc.
• Plausible Insights OÜ
• Crisp IM SARL
• Tally BV

In addition, 23 AI providers can receive the content of a request routed to them. The full list, with purpose, data, location and transfer mechanism for each, is on the sub-processor page, which is generated from the same provider catalogue the router uses.

4. CLOUD Act exposure per route

A route is an AI provider together with a hosting region it serves from. Exposed means the provider entity, or a parent company, can be compelled to disclose data under the US CLOUD Act. That depends on who controls the provider, not on where it hosts, so a European region of a US-controlled provider is still exposed. A provider whose status is not attested counts as exposed. EU-sovereign applies to the route: an EU-sovereign provider serving from an EU or EEA region. The same provider serving from elsewhere is not EU-sovereign on that route, which is why this column can differ from the provider-level column on the sub-processor page.

To keep a request off exposed routes, set the deny_cloud_act gate in a routing policy: an exposed route is then never selected, including as a fallback. The CLOUD-Act-free sovereignty filter in the model browser uses the same data.

15 of 61 routes not exposed · 46 exposed.

Hosting regions are the regions each provider offers. Which of them serves a given model depends on the model; the model browser shows the regions per model.