Sub-processors
Last updated: 11 November 2026. Version 1.0
Mantia Ltd uses the providers below to provide its services: Mantia Essentials, managed assessments, and any service we add later. For each provider, this page says what it does for us, what it handles, where it processes data, and what protects data sent outside the UK. The first list is the list of Approved Subprocessors under our Data Processing Terms; for a managed assessment, your order form may add another AI model provider (see "Which AI model provider does what"). We keep this page up to date, and tell you before it changes (see "When this list changes").
What the safeguards mean. Under the UK Extension to the EU-US Data Privacy Framework, US companies that certify to the framework can receive personal data from the UK, and the UK government recognises their protection as adequate. The UK Addendum is the UK Information Commissioner's addition to the EU's standard contractual clauses, which are model contract terms for sending data abroad. Both are recognised ways of protecting personal data sent outside the UK. If you are in the European Economic Area, the EU recognises UK data protection as adequate until 27 December 2031, so sending your data to us needs no extra contract terms. We store Mantia Essentials orders with Netlify in Germany, in the EU. Netlify is a US company, so the safeguard in its row applies as well. For each of our providers, the safeguard is shown below.
They handle what you give us to test
These providers may handle personal data in your documents, your example messages or your test accounts, or in your agent's replies. For a managed assessment, your materials reach us only through these providers, by the route your order form sets.
| Provider | What it does for us | What it handles | Where it processes data | Safeguard for data sent outside the UK |
|---|---|---|---|---|
| Netlify (Netlify, Inc.) | Hosts your results site, which Netlify's password protection keeps private. For Mantia Essentials, also hosts our order site and stores your order | Your results. For Mantia Essentials, also everything you submit through the order site, including your key. It also logs visits to our sites, as our processor under its data processing agreement; our Privacy Policy covers those logs | Mantia Essentials orders, documents and keys are stored in Frankfurt, Germany (EU), and cached on Netlify's global network when read (Netlify storage). The order site's server code also runs in Frankfurt (Netlify function regions). Sites are served from Netlify's global network. | Certified to the UK Extension to the EU-US Data Privacy Framework (Netlify privacy policy), with the UK transfer terms in Netlify's data processing agreement where that does not apply |
| Anthropic (we contract with Anthropic Ireland, Limited) | Its models judge the test conversations. Our team also uses Anthropic's AI assistant, on a business plan under Anthropic's commercial terms, to help review conversations and prepare your results | The test conversations and your documentation, including anything you mark as your agent's instructions, and drafts of your results | Stored in the United States. Requests and some of Anthropic's internal work may happen in other countries (Anthropic: where data is processed) | The UK Addendum to the EU standard contractual clauses (Anthropic data processing addendum) |
| OpenAI (OpenAI OpCo, LLC) | Its models carry out the other testing roles: they prepare the tests and play the customers and attackers in the test conversations | The test conversations, and your answers and documentation where a test uses them. Only its models that prepare the tests see anything you mark as your agent's instructions; we never give it to the models that play customers and attackers. | The United States and other countries where its cloud providers operate (OpenAI sub-processor list) | The UK Addendum to the EU standard contractual clauses (OpenAI data processing addendum) |
| Google Workspace (Google Cloud EMEA Limited, with Google LLC) | Our email (hello@mantia.co.uk, and essentials@mantia.co.uk, the address Mantia Essentials order emails come from; Resend sends the automatic ones), and Google Drive, where we keep an encrypted file of your test results until we delete it and empty it from the Drive bin | Emails you send us, the encrypted results file, which includes the conversations, and our own business records under our Privacy Policy, including signed order forms | Any country where Google or its subprocessors maintain facilities, subject to Google's data location commitments (Google data processing addendum, section 10.1) | For the United States, Google LLC's certification to the UK Extension to the EU-US Data Privacy Framework (Google transfer terms). For other countries, the standard contractual clauses in Google's data processing addendum |
Which AI model provider does what. The table shows how Anthropic's and OpenAI's models share the testing now. We may change which does which, and which of their models we use; this page always shows the current arrangement. The model that judges a conversation is always made by a different company from the model that played it. For a managed assessment, your order form names the models we will use, and we change them only with your written agreement. You may also ask for or agree to models from another provider. That provider handles data only for the managed assessments whose order forms name it, so we do not add it to this page or email our other customers. Your order form names it and says what it does, where it processes data, how long it keeps data and what protects data sent outside the UK, and we use it only on terms under which it does not train its models on what we send.
Our AI model providers' own rules. By default, neither Anthropic nor OpenAI trains its models on what we send, and we will not opt in.
- Anthropic deletes what we send within 30 days. It may keep it longer to enforce its usage policy or where the law requires. If a conversation is flagged as breaking its usage policy, Anthropic keeps it for up to 2 years and its safety scores for up to 7 years (Anthropic retention).
- Anthropic's AI assistant, on our business plan: chats and any project files stay in our account until we delete them, on the same schedule as the rest of your data. Anthropic then removes them from its systems within 30 days, subject to the same exceptions as above. The assistant's memory feature is off for customer work. Anthropic's terms bar it from training on them, we have switched off the setting that lets our team rate chats, and we will not opt in to training; either would allow it (Anthropic retention; Anthropic: model training). We never paste your key into them.
- OpenAI keeps abuse-monitoring logs for up to 30 days. It may keep data longer where the law requires, or where needed to protect its services or others from harm. We use OpenAI only through services for which OpenAI lists no application state retention, with any option to store responses switched off, and no OpenAI feature that keeps data until we delete it (OpenAI: data controls).
When we delete. We delete your data on the schedule our Data Processing Terms set for each service. Our providers then remove it from their own systems on their own schedules: Google within 180 days at most (Google data processing addendum, section 6.1); Netlify's data processing agreement gives no timescale; Anthropic and OpenAI as above. Attack-style testing sometimes gets conversations flagged. We cannot delete the providers' copies sooner than their own rules allow.
They help run our services, but never handle personal data from what you give us to test
None of these providers handles personal data from your documents, your test material or your agent's replies. The personal data some of them do handle, such as your contact and payment details, is covered by our Privacy Policy.
| Provider | What it does for us | What it handles | Where it processes data | Safeguard for data sent outside the UK |
|---|---|---|---|---|
| Notion (Notion Labs, Inc.) | Our workspace. It holds our internal order tracker; our own business records, covered by our Privacy Policy: contacts for managed-assessment clients and prospects, and our accounting records; and, for a managed assessment, the goal sets we write from your documents | The tracker: your company name, your order's status and times, and our own cost and hours. Our own records, under our Privacy Policy: business contacts for managed-assessment clients and prospects (names, work email addresses and notes), and our accounting records (invoices and payments, with company names, amounts and any payer's name on an invoice). The goal sets: rules written from your documents, with no personal data in them, on a page only the team members who work on your engagement can open, and we do not use Notion's AI features on it. We delete them, including from Notion's trash, on the end date in your order form or, if it sets none, 30 days after your final results. Never personal data from what you give us to test, your key, your documents, the conversations or your findings | United States | None needed for what you give us to test, because Notion holds no personal data from it. Notion's data processing addendum includes the EU and UK standard contractual clauses (Notion privacy help page) |
| Stripe (Stripe Payments Europe, Limited, with Stripe Payments UK Ltd where Stripe's terms add it, and Stripe, LLC) | Takes Mantia Essentials payments on its own payment page, and card payments for managed assessments where the order form agrees | The name, email address, billing address and card details of the person who pays | Stripe's European company is in Ireland. Stripe also transfers data to the United States and other countries, including India (Stripe privacy policy) | For the United States, Stripe, LLC's certification to the UK Extension to the EU-US Data Privacy Framework (Stripe Data Privacy Framework policy). Otherwise, the contractual clauses in Stripe's data transfers addendum |
| Resend (Plus Five Five, Inc.) | Sends Mantia Essentials sign-in codes, order confirmations and our internal new-order alert | Your email address, sign-in codes, your company and agent names, how your agent's replies arrive, and your order number | Sends emails from the EU (Ireland). Resend stores account data, email metadata and logs in the United States (Resend regions) | The UK Addendum to the EU standard contractual clauses, in section 6.4 of Resend's data processing agreement |
| Cloudflare (Cloudflare, Inc.) | Runs a bot check when you ask for a Mantia Essentials sign-in code | Technical details from your browser, such as your IP address | Mainly the United States and the European Economic Area, with access from other countries (Cloudflare privacy policy) | Certified to the UK Extension to the EU-US Data Privacy Framework (Cloudflare privacy policy) |
Other kinds of provider. Our website's contact forms are stored by Netlify and checked for spam by Akismet on Netlify's behalf; our Privacy Policy covers them. Neither ever handles what you give us to test. For managed assessments we may also use accounting services, for invoices and payment records, and e-signature services, for signing order forms. They handle the details on your order form and invoices, never personal data from what you give us to test. We record or transcribe a call only when the person agrees at the start, and then only with Google Workspace's own meeting recording.
Our own people
Only the team members who work on your order or engagement see your key and read the test conversations, and only they can open the folders that hold your results; advisers have no access. We may access your data from outside the UK and the EU. To protect it:
- we work on it only on Mantia's instructions, and only for your order or engagement;
- each of us is bound by a written undertaking to keep it confidential, never to share it, and never to use it for anything else, except to draw the anonymised lessons our Data Processing Terms allow;
- where UK law requires it, our access is covered by the ICO's International Data Transfer Agreement, signed with Mantia, with a transfer risk assessment;
- our computers are fully disk-encrypted;
- order folders and the private file that holds your key are never included in backups of our computers;
- we delete it on schedule.
Whichever of us prepares your order or engagement downloads your key and documents onto their computer, where the tests run (for Mantia Essentials, from our store in Frankfurt). Your key stays in a private file on that computer until we delete it. It never goes into our chats with Anthropic's AI assistant. The code we write to connect to your agent stays in your order's folder and never reaches our code repository. Wherever your materials land on their way to us, our mailbox included, we delete them on the schedule our Data Processing Terms set for your service.
Our team reads the test conversations as part of the review. If the automated judge declines to rule on a conversation, one of us reviews it and rules, and your results mark it "Reviewed by the Mantia team".
When this list changes
At least 10 business days before a new provider starts handling what you give us to test, we update this page and email every customer whose data we still hold, at the address in its order or order form. We email them in the same way at least 10 business days before anyone new in our team starts working on customer data. You then have 30 days to object, as our Data Processing Terms set out. This does not apply to an AI model provider named only in a managed assessment's order form: that client approves it by signing, and we do not add it to this page.