Sub-processors

Last updated: 13 October 2026

This page lists the service providers ("sub-processors") that process personal data on Ayla's behalf, what each one does, and where it processes data. It is the list our Privacy Policy points to, and we keep it current: when a provider is added or replaced, this page changes before the provider starts processing your data.

Ayla is operated by Ayfinity Labs S.à r.l.-S (Luxembourg). For Ayla's own services we are the data controller. For the records property managers keep in the Ayla portal, we act for the manager, and the providers listed in Annex IV of our Data Processing Terms handle those records on our instructions. Every provider below processes data only on our instructions, under a contract that requires it to protect your data and to use it for nothing else. Our AI providers are additionally barred from using your data to train their models.

We have built Ayla to process personal data inside the European Union. Where a provider's parent company is based outside the EU, we rely on the European Commission's Standard Contractual Clauses (SCCs) so your data keeps EU-level protection. Section 9 of the Privacy Policy explains this in more detail.

AI processing

  • Amazon Web Services EMEA SARL (Bedrock, running Anthropic Claude). The main AI that reads your conversation and writes Ayla's replies. It also writes the short introduction of you that the people deciding on you see, from what you told Ayla. It is also the backup for some of our other AI tasks, and one of the two AI routes we use internally to review conversations so we can improve the service. Processes in the EU. AWS also keeps an encrypted copy of our database for 26 days, in the EU (Frankfurt). In the Ayla portal, it will also read lease documents for property managers, in the EU (Frankfurt), once we start using it for that.
  • Google Cloud (Vertex AI). The AI that reads your conversation to note what you are looking for, and helps rank matches. It is also the backup that writes Ayla's replies, and your introduction, when the main AI is unavailable. Processes in the EU. In the Ayla portal, it runs the AI chat for property managers and reads lease documents.
  • Requesty (EU AI router, running Anthropic Claude and Google Gemini). The second of the two AI routes we use internally to review conversations (AWS, above, is the first). It does not take part in the conversations themselves. Stores and processes in the EU (Frankfurt), routes only to EU data centres, and is set so that the contents of our requests are not logged.
  • Mistral (La Plateforme). An alternative AI for some of the tasks above. Processes in the EU (Paris).
  • Microsoft Azure (OpenAI Service). Converts your voice messages to text, in WhatsApp and when you speak to Ayla on your profile page. Processes in the EU (Sweden). Ayla does not keep recordings made on your profile page, or their text.

Messaging

  • Meta (WhatsApp Business Cloud API). The WhatsApp channel you talk to Ayla through. Meta necessarily processes your phone number and message content to deliver messages. Messages travel through Meta's own global systems, protected by Meta's legal safeguards, including Standard Contractual Clauses. Once Ayla offers it, property managers can also send lease documents to Ayla on WhatsApp. Meta keeps media for about 1 hour after delivery.

Identity verification

  • Didit. The identity-verification partner for the forming-flatshare track (and for the women-only track, if identity checks are switched on there). Didit handles the ID document and selfie on the EU side and returns only the result to Ayla. We never receive or store the images, and Didit only receives data when you go through a verification. Didit holds the ID document and selfie for one month, then deletes them, and it does not use your data to train its models.

Hosting, database, and operations

  • Cloudflare. Application hosting, conversation storage, uploaded photos, and documents. Processes in the EU.
  • Neon. The database that holds profile and matching data, with the most sensitive fields encrypted. Processes in the EU.
  • Vercel. Hosting for this website and our web portals, and cookieless website analytics (aggregate visit and click counts, no cookies, no individual tracking). The website is hosted in the EU (Frankfurt). The analytics are anonymous and cookieless by design: visits are counted from a short-lived hash, no cookie is set, nothing is stored on your device, no IP address is kept, and no visitor is followed across websites. We see counts and trends, never an individual visitor.
  • LangFuse. Observability for our AI calls, so we can check quality and fix problems. EU-hosted.
  • Sentry. Error monitoring. We remove personal details before they reach it wherever we can. Processes in the EU (Frankfurt).

Changes to this list

This list will change as Ayla grows, for example when we add a payment processor. We update this page before a new provider starts processing your data. If you have a question about any provider here, or you object to a change, contact us at privacy@ayla.lu or on WhatsApp at +352 404 002.

Property managers using the Ayla portal are told about changes by email at least 30 days before a new provider starts handling their records, and can object.

Talk to Ayla