LEGAL
Data Processing Addendum Subprocessor List
Subprocessor List
Authorized providers that Process Customer Personal Data on behalf of 4Camp
Version 1.2 | Effective date: September 29, 2026 | Last updated: September 29, 2026
About this list
This page identifies the third parties authorized by 4Camp, Inc., a Delaware corporation (“4Camp”), to Process Customer Personal Data on 4Camp's behalf in connection with providing the Services. Capitalized terms used but not defined in this document have the meanings given in the Data Processing Addendum (the “DPA”).
This Subprocessor List is incorporated into the DPA by reference. Identification of a primary processing location does not constitute a commitment to Process or retain Customer Personal Data exclusively in that location. Any binding data-residency commitment must be expressly stated in the applicable Service Plan, Order Form, or other written agreement with 4Camp.
Current Subprocessors
Amazon Web Services
| Legal entity | Amazon Web Services, Inc., or the applicable Amazon Web Services contracting entity identified in 4Camp's AWS account agreement |
|---|---|
| Services provided | Primary cloud infrastructure used to provide CAMP, including hosting, computation, networking, databases, storage, backup, logging, monitoring, and security services |
| Customer Personal Data | Customer Personal Data transmitted to, processed through, temporarily retained by, or stored within CAMP functionality hosted on AWS |
| Primary location | United States, using the AWS regions configured by 4Camp; limited support, security, or related processing may occur in other locations in accordance with applicable AWS terms and the DPA |
AWS Privacy | AWS GDPR Center | AWS Subprocessors
Google Cloud and Google AI
| Legal entity | Google LLC, or the applicable Google or Google Cloud contracting entity providing the relevant services |
|---|---|
| Services provided | Cloud infrastructure and platform services used for designated CAMP functionality, which may include computation, networking, storage, databases, backup, logging, monitoring, analytics, security, and Google AI model and inference services used directly or through a multi-model supplier for 4Camp-Supplied Models |
| Customer Personal Data | Customer Personal Data transmitted to, processed through, temporarily retained by, or stored within applicable CAMP functionality using Google Cloud Platform or a Google AI model or inference service, including prompts, instructions, files, model inputs and outputs, and associated request metadata as applicable |
| Primary location | United States, including Google Cloud regions configured by 4Camp where applicable; support, security, model inference, or related processing may occur in other locations in accordance with applicable Google terms and the DPA |
Google Cloud Privacy | Google Cloud Data Processing Terms | Google Cloud Subprocessors
OpenRouter
| Legal entity | OpenRouter, Inc. |
|---|---|
| Services provided | Multi-model inference routing used to provide access to 4Camp-Supplied Models through 4Camp's OpenRouter account; this entry does not apply when Customer connects to OpenRouter using Customer's own account or API key |
| Customer Personal Data | Prompts, instructions, files, model inputs and outputs, and associated request metadata transmitted through OpenRouter for an applicable 4Camp-Supplied Model; 4Camp does not intentionally provide Customer identity, tenant information, or billing information as part of those model requests |
| Primary location | United States; Customer Personal Data may be processed in other locations by OpenRouter and applicable downstream model or inference providers in accordance with their terms and the DPA |
OpenRouter Privacy | OpenRouter Terms | OpenRouter Providers
Customer-Selected Third-Party Services
CAMP may permit Customer to connect or invoke third-party software, artificial-intelligence models, inference services, data sources, integrations, cloud services, or other services through Customer's own separate account, agreement, credentials, or independent instructions.
A provider is not a 4Camp Subprocessor solely because Customer connects or invokes it through CAMP under Customer's own relationship with that provider. Customer is responsible for evaluating and authorizing such customer-selected services, including their privacy, security, retention, training, and data-location practices.
Future 4Camp-appointed providers
If 4Camp later appoints a provider to Process Customer Personal Data on 4Camp's behalf in providing the Services, 4Camp will treat that provider as a Subprocessor and update this list in accordance with the DPA before the provider begins such Processing.
Changes to Subprocessors
4Camp may add or replace Subprocessors in accordance with Section 4.2 of the DPA.
For Customers using a Self-Service Plan, including a free or evaluation Service Plan, publication of a change at the location identified in the DPA constitutes notice. Unless otherwise stated, an addition or replacement will become effective no earlier than fifteen (15) days after publication.
For Customers that are not using a Self-Service Plan, 4Camp will provide notice through the method specified in the applicable Order Form or, if no method is specified, through Customer's designated account or legal contact.
Pending Changes
Current status
No pending Subprocessor changes as of September 29, 2026.
Customer Objections
Customer may object to a new Subprocessor only on reasonable grounds relating to the protection of Customer Personal Data or Customer's documented data-location obligations under applicable Data Protection Law.
Unless otherwise expressly provided in an applicable Order Form, Customer's sole and exclusive remedy is to terminate the affected Services that 4Camp identifies as dependent on the new Subprocessor. Customer must exercise that remedy through 4Camp's standard cancellation process or by written notice to legal@4camp.ai within ten (10) days after notice is provided under the DPA.
The complete objection and termination terms are stated in Section 4.2 of the DPA. If this document conflicts with the DPA, the DPA controls.