1. What this page is
A subprocessor is a third party we engage that may process personal data in the course of delivering the service. This page lists them all. It forms part of our privacy policy and of our data processing agreement, and the general authorisation given in that agreement is an authorisation of the parties listed here.
2. Current subprocessors
| Subprocessor | Purpose | Processing location | Status |
|---|---|---|---|
| Google Cloud Platform / Firebase (Google Ireland Limited) | Application hosting, application database (Firestore), file storage (Cloud Storage), background processing, and secret management. | the United States (us-central1); other locations where a customer's order form names one | Active |
| Amazon Web Services, Inc. — Simple Email Service via AWS Lambda | Delivery of transactional email: workspace invitations, notifications, and messages sent through the contact form on this site. | the United States (us-east-1) | Active |
| Stripe, Inc. | Subscription billing and payment processing. Processes billing contact and payment details; it does not receive workspace assessment data. | European Union and United States | Not yet enabled |
| Google Analytics 4 (Google Ireland Limited) | Aggregated measurement of how the marketing website is used: pages read, referrer, and approximate location derived from the IP address. Loaded only for visitors who consent to analytics, and never on the application itself. | European Union, with onward transfer to the United States | Active — consent only |
Google Cloud hosts the platform and holds customer workspace data — inventories, findings, evidence documents and generated reports — in the us-central1 region, in the United States, unless a customer’s order form names another location, in which case that customer’s workspace is stored there instead. That is a transfer outside the European Union; its basis is set out on the privacy page.
Amazon Simple Email Service receives only what an outgoing message contains: recipient and sender addresses, subject, and body. It does not have access to workspace data. It runs outside the European Union, and that transfer is described in full on the privacy page.
The contact form uses no third-party anti-automation service. It is protected by a hidden field, a signed timestamp, and a rate limit computed on this server, so submitting it sends nothing to any party other than us and the mail provider that delivers the message.
Stripe is listed because billing is a planned part of the service. It is not enabled at the date shown at the top of this page, and no payment data has been processed through it.
Google Analytics receives data from the marketing website only, and only from visitors who have consented to analytics. A visitor who refuses, or who has not yet answered the cookie banner, sends it nothing at all: the tag is not loaded, so no request reaches Google and no analytics cookie is set. It never receives workspace data, and it is not present on the application.
3. What each one is bound by
Each subprocessor is engaged under terms that impose data protection obligations no less protective than those we owe our customers, including confidentiality, security measures appropriate to the risk, and assistance with data subject requests. We remain fully liable to our customers for their performance.
4. Changes to this list
We will give customers advance notice before adding or replacing a subprocessor, and the date at the top of this page records when the list last changed. A customer may object on reasonable data protection grounds under the data processing agreement.
Notice is given at least 30 days before the change takes effect, by email to each workspace owner. To have notices sent to a different address — a security mailbox or a shared procurement inbox — write to privacy@audidesk.com and we will add it to the list.
5. Questions
Questions about any party on this list go to privacy@audidesk.com.