Sub-processors
What this page is
To run Niro, we use a few outside companies. Some of them handle your data on our behalf. The law calls them "sub-processors", and it says we have to tell you who they are.
This page is that list. It is complete.
The list
| Company | What it does for us | Where your data is held |
|---|---|---|
| Amazon Web Services | Runs our servers and stores your files | Ireland (EEA) |
| Verda | Runs our indexing machines and the AI models we host ourselves | UK and EEA |
| Groq | Runs AI models we send questions to | United States |
| OpenAI | Runs AI models we send questions to | United States |
| Google Workspace | Our email and shared documents | EEA |
| Neo4j AuraDB | Managed database for the code map | EEA |
About the AI suppliers
This is the part most people ask about, so here is the detail.
We do not let anyone train AI models on your code. We have turned off data retention in our account settings with every AI supplier we use. That means they do not keep what we send them, and they cannot use it to train their models.
We remove sensitive values before sending anything. Content passes through a masking layer first, which looks for secrets and personal data and strips them out. We are honest that this works on a best-effort basis. It is very good, but we do not promise it catches every single value.
Some AI work never leaves our own systems. We host some models ourselves on Verda. When one of those answers your question, no outside AI company sees anything at all.
About the US suppliers
Groq and OpenAI are based in the United States. Sending personal data there needs extra legal protection, so we put the standard clauses approved by the European Commission in place.
Everything else stays in Ireland or the wider EEA.
What is not on this list
Our product analytics. We run these on our own servers rather than paying an outside analytics company. Nobody else sees that data, so there is no third party to list.
Suppliers that never touch your data. For example, our accounting software. It holds our records, not yours.
When this list changes
If we want to add a new sub-processor, we tell you at least 30 days before they start.
If you are not happy with the new supplier, you can tell us why. We will try to sort it out. If we cannot, and we cannot run that part of the service without them, you can cancel that part and we will refund what you have paid for the time you did not use.
Questions
Email privacy@niro.ai.