Ingram Cloud

Subprocessors

Last updated: 2026-07-29

This page lists the third parties appointed by Ingram Technologies SRL to process Customer Personal Data on Ingram's behalf in providing Ingram Cloud.

It forms part of the Ingram Cloud Product Annex to the Ingram Data Processing Addendum.

Change notifications and objections

For a planned appointment or replacement, Ingram will:

  1. update this page; and
  2. send notice to the Customer's account email

at least 30 days before the new Subprocessor begins processing Customer Personal Data.

Where an urgent replacement is reasonably necessary to address a security risk, service failure, legal requirement, or material threat to service continuity, Ingram may make the replacement sooner. Ingram will notify affected Customers as soon as reasonably practicable and explain the reason for the urgent change.

A Customer may object to a new or replacement Subprocessor on reasonable, documented data-protection grounds by emailing privacy@ingram.tech. The process and available remedies are described in section 10 of the DPA.

Platform Subprocessors

Amazon Web Services EMEA SARL

  • Purpose: The Ingram Cloud API and its database, object storage for uploaded files, and the infrastructure behind Ingram's error reporting and observability.
  • Processing location: Paris, France.
  • Data processed: Everything Ingram Cloud stores: account and smith records, conversations, memory, uploaded and reference material, and activity, audit and usage records, together with application error events.
  • Transfer safeguard: EEA processing for the described production workloads. AWS contractual transfer safeguards apply to any permitted support access or onward processing that constitutes a restricted transfer.
  • More information: https://aws.amazon.com/compliance/gdpr-center/

Vercel Inc.

  • Purpose: Hosting for the Ingram Cloud console and its runtime logging.
  • Processing location: Paris, France. Vercel is a globally operated provider.
  • Data processed: Console request metadata, IP addresses, session data, and runtime logs. Conversation content passes through console requests when a signed-in user views or sends it; the console stores none of it.
  • Transfer safeguard: The European Commission SCCs and any applicable adequacy mechanism identified in Vercel's data-processing terms.
  • More information: https://vercel.com/legal/dpa

Cloudflare, Inc.

  • Purpose: DNS, network and edge security, and transactional email delivery for the console.
  • Processing location: Global.
  • Data processed: IP addresses, DNS and request metadata, security events, email addresses, and the contents and headers of transactional email.
  • Transfer safeguard: EU-US Data Privacy Framework where applicable and the European Commission SCCs under Cloudflare's DPA.
  • More information: https://www.cloudflare.com/cloudflare-customer-dpa/

Model Subprocessors

These process Customer Personal Data only when the Customer uses Ingram's managed model access. Where the Customer supplies its own account or key with a provider, that provider is not an Ingram Subprocessor. See section 4 of the Product Annex.

All of them are contractually prohibited from using Customer Personal Data to train or improve their models.

Amazon Web Services EMEA SARL — Amazon Bedrock

  • Purpose: Serving the Claude and GPT models Ingram offers.
  • Processing location: European Union for the models AWS serves from an EU region; United States for models served only from US regions.
  • Data processed: What each conversation sends to the model: the Customer's instructions, the conversation content, and the results of any action taken, together with the model's response.
  • Transfer safeguard: EEA processing where the model is served from an EU region; otherwise the European Commission SCCs under the AWS Service Terms.
  • More information: https://aws.amazon.com/compliance/gdpr-center/

Google Ireland Limited

  • Purpose: Serving the Gemini models Ingram offers.
  • Processing location: Global.
  • Data processed: What each conversation sends to the model, and the model's response.
  • Transfer safeguard: The European Commission SCCs under Google's Cloud Data Processing Addendum.
  • More information: https://cloud.google.com/terms/data-processing-addendum

OpenAI Ireland Limited

  • Purpose: Serving GPT models, and indexing the reference material a Customer gives an agent, where these are not served through Amazon Bedrock.
  • Processing location: United States.
  • Data processed: What each conversation sends to the model and the model's response, and the text of reference material submitted for indexing.
  • Transfer safeguard: The European Commission SCCs under OpenAI's data processing addendum. Ingram turns off OpenAI-side retention of conversation content.
  • More information: https://openai.com/policies/data-processing-addendum/

Anthropic Ireland, Limited

  • Purpose: Serving the Claude models Ingram offers, where these are not served through Amazon Bedrock.
  • Processing location: United States.
  • Data processed: What each conversation sends to the model, and the model's response.
  • Transfer safeguard: The European Commission SCCs under Anthropic's Commercial Terms and data processing addendum.
  • More information: https://www.anthropic.com/legal/commercial-terms

Jina AI GmbH

  • Purpose: Retrieving a public web page on an agent's behalf and returning its text.
  • Processing location: Germany. Jina is a globally operated provider.
  • Data processed: The address of the page an agent retrieves, and the content returned. Conversation content is not sent.
  • Transfer safeguard: The European Commission SCCs where Jina's processing constitutes a restricted transfer.
  • More information: https://jina.ai/legal/

Customer-authorized systems

The following are not Ingram Cloud Subprocessors. Ingram Cloud reaches them on the Customer's instruction, under the Customer's own relationship with the provider, and the Customer configures and can revoke that access at any time.

  • Systems and applications the Customer connects to an agent, including the Customer's own internal systems.
  • Messaging channels the Customer connects using its own credentials, such as Slack, Discord, Telegram, WhatsApp and email, and any endpoint the Customer registers to receive events.
  • Model providers the Customer holds its own account with, which process under the Customer's direct relationship with them.

Ingram's own processing

Stripe Payments Europe, Ltd. (Ireland) processes payment and billing information for Ingram Cloud subscriptions and credit purchases. That is Ingram's own processing as an independent Controller under section 2.3 of the DPA, not processing on the Customer's behalf, and is described in the Privacy Policy.