Public site & back‑office
| Sub‑processor | Purpose | Jurisdiction | Mechanism |
|---|
| Amazon Web Services (AWS) | Site hosting, S3, KMS, CloudFront, CloudTrail | USA (us‑east‑1) · EU (eu‑west‑1) | SCCs · AWS DPA |
| Managed SaaS platform | SaaS hosting platform for the agents | USA | SCCs · Provider trust center available under NDA |
| Cloudflare | DNS, WAF, DDoS mitigation | Global | SCCs · Cloudflare DPA |
| GitHub (Microsoft) | Code repositories and CI/CD for the site | USA / EU | SCCs · Microsoft DPA |
AI model providers
| Sub‑processor | Purpose | Jurisdiction | Mechanism |
|---|
| Amazon Bedrock (preferred) | LLM inference inside AWS managed environment, no foundation‑model training on customer data | USA (us‑east‑1) · EU (eu‑central‑1) | SCCs · Bedrock DPA |
| OpenAI (Enterprise/ZDR) | LLM inference via API; ZDR opt‑in available; no foundation‑model training on customer data | USA | SCCs · API Data Usage |
| Anthropic (Claude API) | LLM inference via API; no training on customer inputs/outputs | USA | SCCs · Commercial terms |
Communication, CRM & analytics
| Sub‑processor | Purpose | Jurisdiction | Mechanism |
|---|
| Microsoft 365 | Corporate email, SharePoint (Sites.Selected scope), Teams | USA / EU | SCCs · Microsoft DPA |
| Microsoft Clarity | Heatmaps, session replay with masking | USA | Opt‑in via banner · SCCs |
| Google Analytics 4 | Aggregate metrics with anonymized IP | USA | Opt‑in via banner · SCCs |
| LinkedIn (Insight Tag & Ads) | B2B campaign measurement | USA / EU | Opt‑in via banner · SCCs |
| HubSpot | CRM and email marketing (newsletter, follow-up) | USA / EU | SCCs · HubSpot DPA |
Change notification
Data Riders notifies contracted clients about additions or removals of sub‑processors with at least 30 days advance notice, per the DPA. Site visitors will see the updated version on this page.
Version history
- 2026‑04‑27 (G40): public page created. Includes AWS, managed SaaS platform, Cloudflare, GitHub, Bedrock, OpenAI, Anthropic, Microsoft 365, Clarity, GA4, LinkedIn, HubSpot.
Contact
[email protected] · DPO: Fernando Damasio.