Avidnote subprocessors
Avidnote is provided by Avidemic AB, a Swedish company. We use the subprocessors below to deliver the service. Each one is bound by a data processing agreement and by the GDPR, and only receives the data needed for its task.
User data is stored in the EU, on servers in Sweden, and is never used to train AI models. Last updated: 2 November 2026.
AI processing: two endpoints
Avidnote’s AI features run through one of two providers, both covered by GDPR-compliant data processing agreements:
- Microsoft Azure OpenAI (EU). Processing and storage stay in Sweden. This is the default for universities and organisations in the EU/EEA that sign a DPA with us, and the setup we recommend for European institutions. Annex 1 of our Data Processing Agreement lists the subprocessors that apply under it.
- OpenAI (standard). Used for other accounts, under OpenAI’s DPA with Standard Contractual Clauses.
Each account uses one endpoint only, and AI content is never used to train models. If your institution needs the Azure EU endpoint, contact us. We set it up for every user with your institution’s email domain, including future sign-ups.
Sub-processor 1: Hostup
Company’s full name: Hostup AB
Company reg. number: Org.nr 559290-1325
Company address: Mässvägen 4, 125 30 Älvsjö, Sweden
Purpose: Primary hosting and data storage.
Categories of personal data: User data, application data, metadata, IP addresses.
Location of processing: Sweden (EU).
Sub-processor 2: Microsoft (Azure OpenAI), institutional endpoint, EU
Company’s full name: Microsoft Ireland Operations Limited
Company reg. number: 256796
Company address: 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Purpose: Natural language processing for the AI features, for institutions that use our EU endpoint (the default under institutional DPAs in the EU/EEA). Not used for model training.
Categories of personal data: User input text.
Location of processing: Sweden (EU) only. Both processing and storage stay in the EU.
Sub-processor 3: OpenAI (standard endpoint)
Company’s full name: OpenAI Ireland Ltd
Company address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland
Purpose: Natural language processing for the AI features, for accounts that are not on the institutional EU endpoint. Used through OpenAI’s business API, where content is not used for model training.
Categories of personal data: User input text.
Location of processing: EU / USA. Processing may take place in the USA. Transfers are covered by OpenAI’s DPA and the EU Standard Contractual Clauses. OpenAI may keep API data for up to 30 days for abuse monitoring, after which it is deleted.
Sub-processor 4: AssemblyAI
Company’s full name: AssemblyAI, Inc.
Company reg. number: 6280120
Company address: 2261 Market Street, Suite 4577, San Francisco, CA 94114, USA
Purpose: Speech-to-text transcription through AssemblyAI’s EU endpoint. Not used for model training. Covered by a DPA and Standard Contractual Clauses.
Categories of personal data: Audio files and transcription data.
Location of processing: EU. Audio and transcripts are processed and stored in the EU.
Sub-processor 5: Bunny
Company’s full name: BunnyWay d.o.o.
Company address: Medvode, Slovenia
Purpose: Content delivery, DNS and protection against cyber-attacks. Also provides redundancy and backup hosting and storage.
Categories of personal data: IP addresses, web traffic data, security logs; for backups also user data, application data and metadata.
Location of processing: EU data centres only: Stockholm, Sweden, with redundancy in Germany.
Sub-processor 6: Visma
Company: Visma (Sweden)
Purpose: Invoicing for universities and institutional customers.
Categories of personal data: Billing contact details.
Location of processing: Sweden (EU).
Sub-processor 7: Stripe (self-serve purchases only)
Company’s full name: Stripe Payments Europe Ltd
Company address: Dublin, Ireland
Purpose: Card payments for plans bought in the app. Not used for institutions billed by invoice.
Categories of personal data: Name, email address and payment details of the paying user.
Location of processing: EU / USA.
Changes to this list
We announce any new or replaced subprocessor on this page before it starts processing personal data, stating its name, purpose, the categories of personal data and where processing takes place. For hosting and storage providers we give at least 30 days’ notice.
Customers with a DPA can object to a change within 14 days on reasonable data protection grounds. If we cannot find a solution together, the customer may end the agreement without penalty.
If we must replace a subprocessor urgently, for example for security reasons, we only use providers established in the EU/EEA that process data within the EU/EEA and comply with the GDPR, and we announce the change within five working days.
2 November 2026: Added OpenAI Ireland Ltd as the AI provider for standard accounts. Institutions in the EU/EEA with a DPA continue to use Microsoft Azure OpenAI in Sweden.
Get notified about changes
To receive an email whenever this list changes, write to [email protected] with the subject “Subprocessor updates” and the address(es) that should be notified.