Appendix: Third-Party Provider List

This Appendix forms an inseparable part of the TrustAI Terms of Service and Personal Data Protection & Privacy Policy.

Part 1. Introduction

This Appendix publishes the list of third-party providers used by Trust Soft to operate the TrustAI platform, including:

• Cloud infrastructure providers and related services
• Large Language Model (LLM) providers
• Monitoring, security, and analytics service providers
• Other technical partners that come into contact with data during service operations.

1.1. How to read this Appendix

Each provider is described with key information:

• Name: trade name and legal entity (if different).
• Service type: the provider's role in the TrustAI ecosystem.
• Processing location: country/region where servers process data, key to assessing cross-border transfer risk.
• Data categories shared: scope of data Trust Soft transfers to the provider.
• Legal basis: Data Processing Agreement (DPA), Standard Contractual Clauses (SCC), or equivalent commitments.
• Policy link: link to the provider's privacy policy.

1.2. Appendix updates

• Trust Soft updates this Appendix on provider changes
• Update notices are sent to Organization Administrators at least 30 days before changes take effect (per Article 14.2 of the Terms of Service)
• The current version is always published at Trust Soft's official address.

Part 2. Large Language Model (LLM) providers

LLMs process prompt content and generate AI responses. They are the most direct content-processing components and require the highest transparency.

2.1. FPT AI Factory (Vietnam)

2.2. Microsoft Azure (United States)

2.3. DeepSeek API (China)

2.4. LLM provider comparison

Part 3. Cloud infrastructure providers

TrustAI prioritizes cloud infrastructure hosted in Vietnam to ensure data sovereignty and compliance with the Cybersecurity Law.

3.1. Primary infrastructure

Note: the specific infrastructure provider name is disclosed to the Organization in the documentation attached to the Service Contract and may be subject to bilateral confidentiality.

3.2. Auxiliary services

Part 4. Monitoring and security providers

These services help Trust Soft detect incidents, ensure performance, and protect the system. They DO NOT process user content, only technical logs and operational data.

Part 5. External channel integration partners

When Organizations enable integrations with external platforms, those platforms participate in data processing in their own roles.

5.1. Zalo Official Account (Zalo OA)

5.2. Meta Platforms (Facebook, Messenger)

5.3. Web Component (embedded on the Organization's website)

• The Web Component is embedded in the Organization's website per the Organization's configuration.
• Trust Soft provides the technology. The Organization owns the website and is the Data Controller for end users visiting it.
• Trust Soft processes messages sent through the Web Component as Data Processor.
• The Organization is responsible for: displaying privacy notices, cookie consent (if applicable), and complying with the privacy policy of its website.

Part 6. Controls and Reviews

6.1. Provider selection criteria

Trust Soft applies the following criteria when selecting third-party providers:

• Hold international security certifications (ISO 27001, SOC 2, or equivalent)
• Commit to comply with Vietnamese law, particularly Decree 13/2023/ND-CP and the Cybersecurity Law
• Have a signed DPA or equivalent commitment in writing
• Commit not to use customer data to train AI models without consent
• Have a clear security incident notification mechanism
• Publish a complete privacy policy.

6.2. Periodic review

• Trust Soft performs risk reviews of third-party providers at least every 12 months.
• Ad-hoc reviews on material changes (provider policy, security incidents, legal changes).
• Review results are retained and made available to Organizations on valid request.

6.3. Organization rights

• Request detailed information about a specific provider (certifications, DPA, storage location).
• Request exclusion of a provider from its data processing under Article 14.3.
• Request periodic reports on the providers processing its data.
• Participate in audits of Trust Soft's processing activities, per Service Contract terms.

6.4. Contact