Who processes your data, besides us.

Our sub-processors

The list below is current as of Jun 19, 2026. Each vendor processes only the data its purpose requires, and always under a data processing agreement. You can find our full terms in our Data Processing Agreement (DPA).

Anthropic ZDR: the key thing to understand

Anthropic is the AI vendor Levano uses. Even though Anthropic is American, we hold an Enterprise + Zero Data Retention agreement:

• Your prompts leave the EU temporarily during processing
• Anthropic deletes the data immediately after the response is delivered
• No long-term storage
• No training on your data
• ISO 42001-aligned governance

This is the current industry standard for compliant AI use in the EU. If the law changes (for example the EU AI Act), we update the setup.

How we vet a sub-processor

No vendor gains access to data before passing the same review:

1. ISO 27001 (or equivalent) required
2. GDPR compliance and a data processing agreement
3. Geographically EU-preferred; alternatives only with stronger controls
4. Financial stability (we don't want to switch vendor every 6 months)
5. Audit rights included in the contract
6. Incident response SLA included

How we notify you about changes

We never add or change a sub-processor without notice. In practice that means:

• 30 days' notice before we add or change
• Email to administrative contacts
• An update on this page with a “new” or “changed” tag
• A right to object (per the Data Processing Agreement)

Change history

Here we log every addition and change as it happens, with date and status.