Subprocessors and security

Security

Effective date: August 26, 2026

This page lists the main providers that support Gradiated and summarises the security measures used in the service. We update it when a material provider or processing purpose changes.

Inference data

Gradiated uses zero data retention for standard inference in its controlled systems. We do not persist prompts, messages, tool payloads, attachments, or generated outputs after request processing. This content can exist in memory while a request is running. We do not write it to the Gradiated product database or application logs.

We retain limited non-content data, including model identifiers, token counts, timing, request status, service identifiers, and billing data. We use this data for billing, security, reliability, support, and legal obligations. We do not use customer content to train or improve models.

Current providers

• Amazon Web Services — cloud hosting, networking, secrets, transactional email delivery, and supporting infrastructure.
• ClickHouse — storage and queries for non-content usage and operational metrics.
• Nebius and RunPod — GPU infrastructure used by selected inference runtimes.
• Stripe — payment processing and billing support.

Provider locations can vary by service and deployment. We use the safeguards described in our Privacy Policy and DPA where required.

Security measures

• Public traffic uses encrypted HTTPS connections.
• Inference services run in isolated infrastructure and are not exposed directly as public application endpoints.
• Access to secrets and operational systems is restricted through service credentials and access controls.
• We record non-content usage and operational events to support billing, reliability, and incident response.
• We review access and service behavior as part of normal operations.

Gradiated is an early-stage service. We do not currently claim SOC 2, ISO 27001, HIPAA, or similar certification. Contact team@gradiated.com for security questions or a customer security review.