Sub-processors

Last updated: 9 July 2026

This page lists the service providers ("sub-processors") that process personal data on Ayla's behalf, what each one does, and where it processes data. It is the list our Privacy Policy points to, and we keep it current: when a provider is added or replaced, this page changes before the provider starts processing your data.

Ayla is operated by Ayfinity Labs SARL-S (Luxembourg), the data controller. Every provider below processes data only on our instructions, under a contract that requires it to protect your data and to use it for nothing else. Our AI providers are additionally barred from using your data to train their models.

We have built Ayla to process personal data inside the European Union. Where a provider's parent company is based outside the EU, we rely on the European Commission's Standard Contractual Clauses (SCCs) so your data keeps EU-level protection. Section 9 of the Privacy Policy explains this in more detail.

AI processing

  • Google Cloud (Vertex AI). The AI that reads your conversation and helps rank matches. Processes in the EU.
  • Amazon Web Services (Bedrock, running Anthropic Claude). The fallback AI for the same tasks when the primary is unavailable. Processes in the EU (Frankfurt).
  • Mistral (La Plateforme). An alternative AI for the same tasks. Processes in the EU (Paris).
  • Microsoft Azure (OpenAI Service). Converts your WhatsApp voice messages to text. Processes in the EU (Sweden).

Messaging

  • Meta (WhatsApp Business Cloud API). The WhatsApp channel you talk to Ayla through. Meta necessarily processes your phone number and message content to deliver messages. Messages travel through Meta's own global systems, protected by Meta's legal safeguards, including Standard Contractual Clauses.

Identity verification

  • Didit. The identity-verification partner for the forming-flatshare track and the women-only eligibility check. Didit handles the ID document and selfie on the EU side and returns only the result to Ayla. We never receive or store the images, and Didit only receives data when you go through a verification.

Hosting, database, and operations

  • Cloudflare. Application hosting, conversation storage, uploaded photos, and documents. Processes in the EU.
  • Neon. The database that holds profile and matching data, with the most sensitive fields encrypted. Processes in the EU.
  • Vercel. Hosting for this website and our web portals. Processes in the EU (Frankfurt).
  • LangFuse. Observability for our AI calls, so we can check quality and fix problems. EU-hosted.
  • Sentry. Error monitoring. We remove personal details before they reach it wherever we can. Processes in the EU (Frankfurt).

Changes to this list

This list will change as Ayla grows, for example when we add a payment processor or a backup provider. We update this page before a new provider starts processing your data. If you have a question about any provider here, or you object to a change, contact us at privacy@ayla.lu or on WhatsApp at +352 404 002.