Security Report AI
Sub-processors
The third parties that process customer data on behalf of the service. The function of each one is listed; identifying and legal details are published once verified.
Status
PLACEHOLDER — the named sub-processor register is prepared but not published: vendor names, processing locations and transfer mechanisms are confirmed and reviewed before publication. The functions performed are listed below, and the completed register is provided in writing to each pilot customer on request.
Application hosting and
- • Application hosting and delivery of the web application.
- • Data: Request metadata, Technical logs
- • Provider: to be published
- • Processing location: to be published
- • DPA: to be confirmed
- • Transfers: to be confirmed
Managed database, authentication
- • Managed database, authentication and private file storage.
- • Data: Account data, Workspace data, Incident reports and audit trail, Uploaded SOP documents
- • Provider: to be published
- • Processing location: to be published
- • DPA: to be confirmed
- • Transfers: to be confirmed
AI gateway routing
- • AI gateway routing requests to the language, transcription and embedding models.
- • Data: Incident narratives, Questions asked, SOP text fragments
- • Provider: to be published
- • Processing location: to be published
- • DPA: to be confirmed
- • Transfers: to be confirmed
Language, speech-to-text and
- • Language, speech-to-text and embedding model providers used to draft reports, transcribe voice input and answer procedure questions.
- • Data: Incident narratives, Voice recordings, SOP text fragments
- • Provider: to be published
- • Processing location: to be published
- • DPA: to be confirmed
- • Transfers: to be confirmed
Transactional email delivery
- • Transactional email delivery (verification, password reset, invitations).
- • Data: Email addresses, Message content of system emails
- • Provider: to be published
- • Processing location: to be published
- • DPA: to be confirmed
- • Transfers: to be confirmed
Changes
Customers are notified before a sub-processor is added or replaced, within the notice period set out in the data processing agreement once that agreement is executed.
Operating entity
- • The operating entity, its registered address, VAT number and published contact addresses are not confirmed yet. They are provided in writing to each pilot customer before any data is entered, and will be listed here once registered.
This register is maintained alongside the product and is updated whenever the set of providers changes.