Last updated: 22 April 2026
L4 Labs Limited engages the following sub-processors to process personal data on behalf of its customers in connection with the Ramsai platform. This list is maintained in accordance with Clause 9 of the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 and is referenced in our Privacy Policy and Terms of Service.
| Sub-processor | Service provided | Location of processing | Data accessed | Transfer mechanism |
|---|---|---|---|---|
| Google LLC / Google Ireland Ltd (Google Cloud Platform) | Hosting, storage, compute, authentication, logging (Cloud Storage, Firestore, Cloud Run, Cloud Functions, Cloud Logging, Firebase Auth, Firebase Hosting) | europe-west4 (Netherlands). Google parent (US) may access for support and security under its DPA. | All customer documents, generated RAMS, certifications, photos, voice notes, account data, audit logs. | Google Cloud Data Processing Addendum incorporating EU SCCs (Decision 2021/914). Supplementary measures: encryption in transit and at rest, customer-region storage. |
| Google LLC (Vertex AI / Gemini API) | Generative AI extraction and reasoning over source documents. | United States. | Source document text and images submitted for AI extraction. | Google Cloud DPA + EU SCCs. No use of customer content for training of generally-available models. |
| Google LLC (Google Maps Platform) | Identifying nearest emergency services for site addresses (Geocoding, Places, Directions). | United States. | Site address (postcode/coordinates) only — no personal identifiers transmitted. | Google Maps Platform terms; no personal data sent. |
| Google LLC (Google Custom Search) | Fallback web search for Safety Data Sheets not in customer knowledge base. | United States. | Product name search query only — no personal data. | Google API terms; no personal data sent. |
| Anthropic, PBC | Generative AI reasoning (Claude API) for hazard analysis and document understanding. | United States. | Source document text submitted for AI extraction. | Anthropic DPA incorporating EU SCCs (Decision 2021/914). Maximum 30-day retention of submitted prompt content; no use for model training. |
| Stripe Payments Europe Ltd (with sub-processing by Stripe, Inc. in US) | Payment processing for customer subscriptions. | EU and US. | Billing contact name, email, address, payment metadata. No customer document data. | Stripe DPA incorporating EU SCCs. |
L4 Labs Limited will update this register before engaging any new sub-processor or replacing an existing one, and will notify all affected customers by email at least 30 days in advance. Customers may, during that notice period, object on reasonable data-protection grounds; if such an objection cannot be resolved in good faith, the customer may terminate the affected services. See Terms of Service §7.5.
Questions about this register can be sent to hello@l4labs.com.