Transparency in Data Processing
To provide the Fusion AI Gateway, API routing, and billing services, Fusion engages trusted third-party service providers ("Subprocessors"). This registry lists all active subprocessors, their corporate entity, country of processing, purpose, and applicable data transfer safeguards.
Platform & Cloud Infrastructure
Core infrastructure providers used to host the edge gateway, maintain user authentication, securely meter token usage, and process billing:
| Subprocessor | Entity & Location | Purpose | Safeguards |
|---|---|---|---|
| Cloudflare | Cloudflare, Inc. Global Edge / USA | Edge serverless compute (Workers), CDN, DDoS mitigation, D1 SQL, and KV caching. | EU Standard Contractual Clauses (SCCs), DPF |
| Suby | Suby Finance (suby.fi) Global / Decentralized | Subscription checkout, billing, and cryptocurrency payment settlement (USDC / USDT). | Merchant Service Agreement & Cryptographic Settlement |
| Better Auth | Open-source Self-Hosted Fusion Dedicated Cloudflare D1 | Authentication credentials, session cookies, and API key management. | Local Edge Execution (Zero 3rd-party egress) |
Model & Upstream AI Providers
When you invoke specific models via your API requests, Fusion securely forwards the request payload to the respective upstream model cluster under strict Zero Data Retention rules:
| Provider | Entity & Location | Purpose | Safeguards |
|---|---|---|---|
| DeepSeek | Hangzhou DeepSeek AI Co., Ltd. APAC / International | Upstream execution of DeepSeek V4 Flash and reasoning models (transient streaming). | Zero Data Retention API Agreement |
| MiniMax | MiniMax Technology Ltd. Global / APAC | Upstream execution of MiniMax M2.7 high-throughput text models. | Zero Data Retention API Agreement |
| Moonshot AI (Kimi) | Moonshot AI Co., Ltd. APAC / International | Upstream execution of Kimi K2.6 long-context inference requests. | Zero Data Retention API Agreement |
| OpenAI | OpenAI, LLC USA | Execution of GPT-4o, o1, and o3 model completions where configured. | EU Standard Contractual Clauses (SCCs), DPA |
| Anthropic | Anthropic, PBC USA | Execution of Claude 3.5 Sonnet and Claude 3.7 Sonnet completions. | EU Standard Contractual Clauses (SCCs), DPA |
| Together AI / Groq | Together Computer, Inc. / Groq, Inc. USA | LPU and GPU low-latency open model inference acceleration. | EU Standard Contractual Clauses (SCCs), DPA |
| Gonka Network | OpenBroker Compute Nodes Global Distributed | Decentralized wholesale compute capacity nodes for budget inference. | Stateless Token Verification & Protocol Routing |
Subprocessor Due Diligence & Standards
Prior to onboarding any new Subprocessor, Fusion conducts a thorough security and compliance review to ensure that the vendor meets stringent data protection criteria:
- Verification of ISO 27001, SOC 2 Type II, or equivalent independent security certifications;
- Execution of formal Data Processing Agreements containing EU Standard Contractual Clauses (SCCs);
- Commitment to Zero Data Retention for customer inference payloads and prohibition of AI training;
- Assessment of encryption standards, incident response protocols, and vulnerability patching.
Notification of Subprocessor Changes
Fusion provides at least fourteen (14) days' advance notice to customers before authorizing any new Subprocessor to process Customer Personal Data.
Notices are posted directly to this Subprocessors Registry page and distributed via email alerts to registered account owners. Customers with an executed DPA may object to a new Subprocessor on reasonable data protection grounds within ten (10) days of receiving notice.
Contact Information
To submit an inquiry or objection regarding subprocessors:
Fusion Vendor Compliance
Subprocessor Inquiries: privacy@fusioncode.app
Enterprise Agreements: enterprise@fusioncode.app