Subprocessors
25 AI provider companies · 166 active models · auto-derived from our model registry
LLM registry last synced with provider gateway: 2026-07-24T00:00:00.000Z
This page lists the third-party companies ("subprocessors") that may process your data when you use Heista. It covers AI model providers and infrastructure providers. The AI provider list is auto-derived from our live model registry on every deployment, so it reflects what we actually have wired up. The list is maintained in line with §3 of our Privacy Policy and §11 of our Terms of Service.
We may add, remove, or change subprocessors at any time. Continued use of the Service constitutes acceptance of subprocessor changes. If you are a customer with rights under the EU GDPR and you wish to object to a new subprocessor, email support@heista.co.
How AI Model Routing Works
Heista routes AI requests across many model providers via a model gateway (currently the Vercel AI Gateway). The gateway lets us pick the right model for each task based on capability, cost, latency, and jurisdiction.
We group AI providers into three jurisdictional tiers. The tier determines what kind of content can be sent to that provider.
| Tier | Jurisdiction | Used for |
|---|---|---|
| Tier 1 | United States | All tasks. Default tier for any task that includes customer-uploaded content. |
| Tier 2 | European Union | Tasks requiring EU-only routing. Available for upload content. |
| Tier 3 | Non-Western (incl. PRC) | Tasks that do NOT include customer-uploaded content. Example: decoding a publicly available competitor ad you pasted as a URL. |
The Tier 3 carve-out for uploads is enforced in code, not just policy. Our model picker is invoked with a containsUserUpload flag whenever a request includes a brand document, ethos document, or any file uploaded via the API or a Heista Skill. When that flag is set, only Tier 1 providers are eligible.
AI Model Providers Currently in Our Registry
Every provider listed below has at least one production model wired into our routing layer right now. Adding or removing a provider here happens automatically when our model registry changes — no manual edit to this page required.
Tier 1 — United States
Jurisdiction: United States
Tier 2 — European Union
Jurisdiction: European Union
Tier 3 — Non-Western (NOT used for customer-uploaded content)
Jurisdiction: People's Republic of China and other non-Western jurisdictions
Important: Tier 3 providers are used only for tasks that do not include customer-uploaded content. The restriction is enforced in our routing code via a content-classification flag, not just by policy. Tier 3 providers may store inference data in jurisdictions whose data protection laws differ materially from US, EU, and Australian regimes (for example, the PRC Cybersecurity Law, Data Security Law, and Personal Information Protection Law may grant government access rights that have no equivalent in your jurisdiction). We have judged that — for non-upload tasks like decoding publicly available marketing content — this risk is acceptable in exchange for the cost and capability benefits. If you require Tier-1-only routing for all of your account's activity, contact us at support@heista.co.
Unclassified
Jurisdiction: Jurisdiction not yet classified
Infrastructure Subprocessors
These are the non-AI providers that process your data as part of operating the Service.
Hosting and Database
Jurisdiction: Australia, United States
Payments and Communication
Jurisdiction: United States
Analytics and Observability
Jurisdiction: United States, European Union
External Data Sources
Jurisdiction: Varies
Contact
Operated by: Mighty Lucky Ventures Pty Ltd (trading as Heista), ABN 51 653 328 628
Email: support@heista.co