Sub-processor List

To provide its state-of-the-art Cloud Services and Artificial Intelligence capabilities, YBA relies on trusted technology partners. In accordance with our Data Processing Agreement (DPA), this page lists the sub-processors that may have access to or process Customer Data on behalf of YBA.

1. Cloud Infrastructure and AI Inference

YBA utilizes a multi-cloud architecture to ensure high availability, data residency within Europe, and access to best-in-class Large Language Models (LLMs). Our primary sub-processors are:

Microsoft Ireland Operations Ltd

Purpose: Cloud infrastructure hosting, database management, and AI model inference (e.g., Azure OpenAI Service).

Location: European Union (France, Ireland).

Amazon Data Services Ireland Ltd

Purpose: Cloud infrastructure hosting and AI model inference (e.g., AWS Bedrock).

Location: European Union (Sweden, Germany).

Google Cloud France SARL

Purpose: Cloud infrastructure hosting and AI model inference (e.g., Vertex AI).

Location: European Union (Belgium, France).

2. Security and Privacy Guarantees

All our sub-processors undergo a rigorous selection and audit process. They maintain the highest industry security standards, including ISO 27001, ISO 27017, ISO 27018, and SOC 2 Type II certifications.

Zero-Training Commitment In accordance with our contractual agreements with our infrastructure providers (Microsoft, AWS, Google), we guarantee that no Customer Content is used by YBA or its sub-processors to train, improve, or fine-tune any foundational or generalized AI models. Data submitted for inference is processed transitionally or stored in logically isolated environments dedicated to YBA.

Data Encryption All data processed by our sub-processors is protected by in-transit encryption using TLS 1.2 or higher protocols, and at-rest encryption using industry-standard AES-256 encryption across all storage and database layers.

3. International Data Transfers

YBA prioritizes storing data at rest within the European Economic Area (EEA). In exceptional cases where temporary technical processing might require a transfer outside the EEA, such transfer is strictly governed by the European Commission's Standard Contractual Clauses (SCCs) to ensure a level of protection equivalent to the GDPR.

4. Updates to this List

YBA may update this list from time to time to incorporate new technologies or improve service performance. In the event of the addition of a new sub-processor, YBA will notify its customers in accordance with the terms set forth in the DPA.

If you have any questions regarding this list or our privacy practices, please contact our team at: privacyandsecurity@yba.ai

Last Updated: Jan 16, 2026