Belo AI Subprocessor List

Status: DRAFT — shown on the production site
Why: who processes data for us (procurement / DPA).
When users see it: public page; referenced by DPA and Trust Center.
URL: 1
Translations: pt-BR · EN · es-ES · fr-FR (same path; app locale)
Source: rascunho 2026-07-11

---

1. Purpose

Belo Inteligência Artificial Ltda (“Belo”) engages the following subprocessors to help provide the Services. Each subprocessor is bound by written data-processing terms imposing obligations at least equivalent to those in the Belo Data Processing Agreement (where applicable).

This list is a versioned procurement artifact. The DPA incorporates it by reference and provides thirty (30) days’ advance notice and objection rights for material additions or replacements for paid customers.

To subscribe to change notifications: privacy@belo.ai or belo@belo.ai (subject: “Subprocessor notifications”).

---

2. Infrastructure and database

---

3. AI model providers

Belo routes generation requests to one or more providers depending on customer model selections and entitlement tier. Prompts and outputs are processed under each provider’s data-processing / enterprise API terms. Belo does not train foundation models on Customer Content. Providers under enterprise API configurations used by Belo are instructed not to use customer inputs to train foundation models.

Provider availability varies by plan and configuration. This list does not guarantee continuous availability of every model.

---

4. Email, authentication, payments, and observability

---

5. BYOC — customer-managed deployments (GCP)

Current BYOC cloud: Google Cloud Platform (GCP) only.

Belo does not currently offer AWS or other-cloud BYOC. Microsoft, where used, is only a social login provider (Microsoft account / Entra ID), not a hosting or BYOC cloud.

For BYOC customers:

• The customer’s GCP project/organization hosts the runtime and Customer Content.
• Belo retains access only to license heartbeat payloads used for commercial/licensing enforcement (aggregate usage and deployment metadata). Heartbeats are not intended to include prompts, schemas, row data, files, embeddings, or end-user PII.
• Whether specific heartbeat fields (e.g., org_id, instance_fingerprint, active-user counts) are personal data under LGPD/GDPR is [OPEN — COUNSEL] and is not settled by this list.
• The detailed field inventory is an internal engineering control and is not published as public contract text.

See the Corporate/BYOC Addendum for support, update, and open-source boundaries.

---

6. Changes and versioning

---

7. Contact

Belo Inteligência Artificial Ltda
Rua da Consolação, 2302, São Paulo/SP – CEP 01302-011 – Brazil
Email: belo@belo.ai / privacy@belo.ai