v7 · Last updated 9 October 2026

Provider Register

Amazon Web Services (AWS) — cloud infrastructure provider

Field	Details
Legal entity	AMAZON WEB SERVICES EMEA SARL
Engaged through	Covailent Ltd, the AWS account owner, acting on ArkaTal’s behalf.
Function	Cloud infrastructure supporting ArkaTal’s platform, including handling platform requests, backend computing and data storage.
Role	Subprocessor for platform personal data processed through Covailent on ArkaTal’s behalf, within the relevant activity and any narrower instructed-processing record.
Data processed	Personal data contained in platform accounts, company and expert profiles, matching and evaluation information, transaction records and technical logs, where handled by the hosted platform.
Hosting locations	United Kingdom and Singapore.
Support access and subprocessors	AWS’s subprocessor register identifies its infrastructure and support entities and their processing locations. Customer-initiated support may involve processing outside the hosting countries where data is shared for that purpose.
Use for AWS’s own model training	Platform content supplied through the cloud infrastructure services we use is not provided for AWS to train its own models. AWS’s permitted use of that content is governed by the AWS Customer Agreement and AWS Service Terms.
Retention	Retention is managed through the platform’s storage and deletion settings, including applicable backup and log-retention periods, in accordance with ArkaTal’s retention requirements.
Contractual safeguards	The AWS Customer Agreement and AWS Service Terms govern the services through Covailent’s AWS account arrangement. The incorporated AWS Data Processing Addendum covers processing instructions, confidentiality, security, subprocessors, incident notification, international transfers and return or deletion of personal data. The Service Terms also incorporate the AWS Supplementary Addendum, providing additional protections concerning government requests for data.
Last updated	9 October 2026.

Covailent Ltd — platform processing and development partner

Field	Details
Legal entity	Covailent Ltd, United Kingdom.
Engaged through	Directly by ArkaTal, acting on ArkaTal’s documented behalf.
Function	Backend data processing; platform design, maintenance and support; security and quality assurance; lawful preparation of eligible sources into Anonymised Development Material; and authorised development, evaluation, training and fine-tuning using that material for ArkaTal, including technology ArkaTal may commercialise under the Platform Terms.
Role	Processor/data intermediary for personal data processed on ArkaTal’s behalf. Where ArkaTal itself acts as a processor under an agreed Client processing record, Covailent acts as a subprocessor only within that record’s authorised scope.
Data processed	Information necessary for assigned services, including personal-account and company-representative details, authorised profiles and experience, matching requirements, proposals, SOW particulars, platform activity, transaction metadata and support records. Eligible recordings, transcripts and ordinary confidential discussion may undergo lawful controlled preparation. Identifiable source processing requires its actual applicable basis, notices and rights; only material meeting the anonymity standard in clause 15 may enter broad development under this route. Exclusions, confidentiality, third-party rights and instructed-purpose limits remain.
Processing and support-access locations	United Kingdom and Singapore. Onward processing through other providers is described in their separate register entries and remains subject to applicable location and transfer controls.
Model training on ArkaTal’s behalf	Permitted within the assigned mandate only using eligible Anonymised Development Material under ArkaTal’s documented instructions and content rights, including technology for licensing, white-labelling and standalone products. Identifiable originals and pseudonymised records are not broad-training inputs under this route. Required preparation and anonymity evidence must exist before the affected use. Client-instructed delivery data is not released for unrelated development merely by anonymising it.
Use for Covailent’s own model training	Not permitted. Covailent is not authorised to use this data to train its own models or models for other customers.
Onward providers	Approved cloud and AI providers may support these services within ArkaTal’s instructions and applicable processing records. Their identities, functions, locations and training treatment are listed separately in this register.
Retention	Limited to the assigned service and applicable category periods and deletion duties in ArkaTal's Privacy Notice, Platform Terms and activity-specific processing record. Copying recordings or verbatim transcripts into development storage does not reset or evade their shorter source-category periods. Copies, logs, backups and relevant distributed artefacts remain subject to applicable retention, correction, restriction and deletion requirements.
Contractual safeguards	Covailent processes data under its written agreement with ArkaTal, which covers documented instructions, confidentiality, security, incident notification, assistance with data rights, onward processing, international-transfer safeguards, and return or deletion of data.
Last updated	9 October 2026.

OpenAI — AI processing provider

Field	Details
Legal entity	OpenAI OpCo, LLC
Engaged through	Covailent Ltd, acting on ArkaTal’s behalf.
Service	OpenAI API
Function	AI processing to support ArkaTal’s platform, including analysing submitted information and generating outputs for matching and evaluation.
Role	Subprocessor where Covailent processes personal data on ArkaTal’s behalf.
Data processed	Relevant information submitted for SoW generation, matching and evaluation, including requirements, company and expert profiles, and personal data contained within those materials.
Processing and support-access locations	International. ArkaTal’s current OpenAI API configuration does not specify a regional processing restriction. Relevant providers and locations are listed in OpenAI’s subprocessor register.
Use for OpenAI’s own model training	Customer content is not used to train or improve OpenAI’s own models. Optional sharing for that purpose is not enabled.
Retention	API requests are configured with response storage disabled. OpenAI may retain customer content in abuse-monitoring logs for up to 30 days, or longer where required by law or reasonably necessary to protect its services or others from harm. Additional retention may apply to specific features, as described in OpenAI’s data controls documentation.
Contractual safeguards	Processing is governed by Covailent’s agreement with OpenAI and the associated Data Processing Addendum, including obligations concerning documented instructions, confidentiality, security, breach notification, subprocessors and return or deletion of personal data.
Last updated	9 October 2026.