If your organization needs a signed Data Processing Agreement to satisfy GDPR Article 28 or a vendor security review, Sandbox provides one on Ultra and Custom plans at checkout — no separate negotiation required for standard terms.

Sub-processors

Because Sandbox routes requests to the model provider you select, our sub-processor list includes OpenAI, Anthropic, Google, xAI and Mistral for their respective hosted models, plus our own infrastructure providers for self-hosted models (Llama, Stable Diffusion open variants) and application hosting. The full current list is available on request.

EU data residency

Ultra and Custom workspaces can be pinned to our Frankfurt region. When pinned, prompts, uploaded files and generations for hosted models are processed only through providers' EU endpoints, and self-hosted models run exclusively on our EU clusters.

Security

We hold SOC 2 Type II attestation, encrypt data in transit (TLS 1.2+) and at rest, and run annual third-party penetration tests. A summary report is available under NDA for Ultra and Custom customers.

Getting a signed copy

Request the DPA through the contact form — mention your company name and plan, and our team returns a countersigned copy within one business day for standard terms.