Subprocessors
Who else touches the data
These third parties process client data on our behalf in the delivery of Action360. Each is engaged under terms covering confidentiality, security and, where personal data is involved, data-processing obligations.
| Subprocessor | Purpose | Data categories |
|---|---|---|
| Application and backend hosting provider | Application hosting, managed PostgreSQL, authentication and object storage | All governance records, user profiles, attachments, audit logs |
| Email delivery provider | Transactional and notification email | Recipient name and work email, notification subject and body |
| AI gateway / model provider | Copilot question answering — inference only | Prompt text and the workspace context included in the prompt |
Commitments
- Copilot prompts are sent for inference only and are not used to train models.
- No client data is shared with advertising networks or data brokers.
- Client data stays within the agreed hosting region. Any transfer outside it is covered by Standard Contractual Clauses.
- Clients are notified before a new or replacement subprocessor is engaged and may object under the DPA.
Named provider entities, their hosting regions and their current attestations are listed in the full documentation pack available from the security page.