How many subprocessors does Baseten use?

Baseten lists 31 subprocessors on its published list, including Amazon Web Services, Google Cloud, Crusoe, Oracle, and Slack and 26 more.

Where does Baseten process customer data?

The subprocessors named by Baseten are located in United States, Global, Canada, France, Iceland, and Sweden and 6 other locations, as stated on its list.

How quickly does Baseten report a personal data breach to customers?

According to its DPA, Baseten reports a personal data breach to customers within 48 hours: “Baseten shall notify Customer without undue delay, and in any event within forty-eight (48) hours, upon discovering a Personal Data Breach affecting Customer Personal Data.”

How much notice does Baseten give before adding a subprocessor?

Baseten's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification.”

How does Baseten transfer personal data outside the EU?

Baseten's DPA relies on standard contractual clauses: “To the extent Processing involves a Restricted Transfer from Customer to Baseten, the Parties shall comply with the SCCs incorporated by reference as set forth in Schedule 1.”

Which security certifications does Baseten list?

Baseten's trust page lists ISO 27001, HIPAA, PCI DSS, and FedRAMP.

When was Baseten's subprocessor list last checked?

ClauseTrail last checked Baseten's subprocessor list on October 6, 2026. Lists are re-checked daily.

How do I find out when Baseten adds or removes a subprocessor?

ClauseTrail monitors Baseten's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Baseten Subprocessors List (October 2026): Changes and History

Baseten names 31 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 6, 2026 Official source ↗

Baseten subprocessors (October 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services	Cloud Infrastructure and Compute	Global
2	Google Cloud	Cloud Infrastructure and Compute	Global
3	Crusoe	Cloud Compute	US, Ireland
4	Oracle	Cloud Compute	United States, United Kingdom, United Arab Emirates
5	Slack	Communications	United States
6	WorkOS	Single Sign On	United States
7	Pylon	Customer Support	United States
8	Orb	Invoicing	United States
9	Coreweave	Cloud Compute	United States
10	Nebius	Cloud Compute	United States, France, Finland
11	Lambda	Cloud Compute	Global
12	Hydra Host	Cloud Compute	United States, Iceland
13	Vultr	Cloud Compute	United States
14	Voltage Park	Cloud Compute	United States
15	Radiant	Cloud Compute	United States
16	Fluidstack	Cloud Compute	United States, Canada
17	Cirrascale	Cloud Compute	United States
18	Boost Run	Cloud Compute	United States
19	Green AI	Cloud Compute	Sweden
20	Corvex	Cloud Compute	United States
21	Ark Data Center	Cloud Compute	United States
22	WhiteFiber	Cloud Compute	Iceland
23	Yotta	Cloud Compute	India
24	ScitiX	Cloud Compute	United States
25	Hyperstack	Cloud Compute	Sweden
26	Latitude.sh	Cloud Compute	United States
27	Parallel AI	Web Search	United States
28	QumulusAI	Cloud Compute	United States
29	Argentum AI	Cloud Compute	United States, Canada
30	Global AI	Cloud Compute	United States
31	Mistral AI	Cloud Compute	France

Get an email when Baseten changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Baseten free

Key DPA terms at Baseten

What Baseten's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 48 hours

“Baseten shall notify Customer without undue delay, and in any event within forty-eight (48) hours, upon discovering a Personal Data Breach affecting Customer Personal Data.”
DPA, www.baseten.co ↗
Notice of a new subprocessor: 15 days ahead

“Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification.”
DPA, www.baseten.co ↗
Transfers outside the EU: Standard contractual clauses

“To the extent Processing involves a Restricted Transfer from Customer to Baseten, the Parties shall comply with the SCCs incorporated by reference as set forth in Schedule 1.”
DPA, www.baseten.co ↗
Customer data after the contract ends: Deleted within 30 days of the contract ending

“For thirty (30) days following cessation (the "Post-Term Period"), Customer may retrieve Customer Personal Data via the Services.”
DPA, www.baseten.co ↗
Audit rights: Once a year

“no more than once annually unless required by a regulator”
DPA, www.baseten.co ↗

Certifications at Baseten

What Baseten's trust page lists, with the text each one comes from.

ISO 27001: Active

“ISO 27001”
Trust page, trust.baseten.co ↗
HIPAA: Active

“HIPAA”
Trust page, trust.baseten.co ↗
PCI DSS: Active

“PCI-DSS”
Trust page, trust.baseten.co ↗
FedRAMP: Active

“FedRAMP 20x”
Trust page, trust.baseten.co ↗

Documents we track for Baseten

DPA: checked October 6, 2026 changed September 30, 2026 www.baseten.co ↗
Privacy policy: checked October 6, 2026 www.baseten.co ↗
Subprocessor list: checked October 6, 2026 trust.baseten.co ↗
Trust page: checked October 5, 2026 trust.baseten.co ↗

Change history

September 30, 2026

DPA changed

Section headings throughout the DPA were given numbers (e.g. "Definitions" became "1. Definitions", "Roles" became "3.1. Roles.") with no changes to the underlying text or obligations.

Tracking since October 6, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Baseten subprocessors FAQ

How many subprocessors does Baseten use?: Baseten lists 31 subprocessors on its published list, including Amazon Web Services, Google Cloud, Crusoe, Oracle, and Slack and 26 more.
Where does Baseten process customer data?: The subprocessors named by Baseten are located in United States, Global, Canada, France, Iceland, and Sweden and 6 other locations, as stated on its list.
How quickly does Baseten report a personal data breach to customers?: According to its DPA, Baseten reports a personal data breach to customers within 48 hours: “Baseten shall notify Customer without undue delay, and in any event within forty-eight (48) hours, upon discovering a Personal Data Breach affecting Customer Personal Data.”
How much notice does Baseten give before adding a subprocessor?: Baseten's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification.”
How does Baseten transfer personal data outside the EU?: Baseten's DPA relies on standard contractual clauses: “To the extent Processing involves a Restricted Transfer from Customer to Baseten, the Parties shall comply with the SCCs incorporated by reference as set forth in Schedule 1.”
Which security certifications does Baseten list?: Baseten's trust page lists ISO 27001, HIPAA, PCI DSS, and FedRAMP.
When was Baseten's subprocessor list last checked?: ClauseTrail last checked Baseten's subprocessor list on October 6, 2026. Lists are re-checked daily.
How do I find out when Baseten adds or removes a subprocessor?: ClauseTrail monitors Baseten's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.