Our sub-processors.
The 10 providers that handle personal data on our behalf. Each has signed a data processing agreement and was reviewed before we started using it.
Last changed 12 October 2026
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| ActiveCampaign LLC (Postmark) Transactional email | Sends sign-in, reminder and notification emails | Name, Email address, Email content (no audit answers) | United States | EU-US Data Privacy Framework + SCCs |
| Amazon Web Services EMEA SARL Hosting, database, backups, object storage | Runs the AuditGlass app, database and encrypted file storage | All customer data (encrypted), Account data | EU: Dublin (eu-west-1); backups Frankfurt (eu-central-1) | None (EU); DPF certified parent |
| Amazon Web Services EMEA SARL (SES) Fallback email | Sends email if Postmark is unavailable | Name, Email address | EU: Dublin (eu-west-1) | None (EU) |
| Anthropic, PBC AI | Drafts questions, quizzes and guidance; Ask the Lens | Redacted prompt text (no names, emails, phones, IDs or IBANs) | United States | SCCs + transfer impact assessment |
| Cloudflare, Inc. DNS, CDN, web application firewall | Protects and speeds up auditglass.ie and app.auditglass.com | IP address, Request metadata | Global edge; EU data localisation suite | DPF + SCCs |
| Google Ireland Ltd Sign in with Google; Ad Manager (free courses only) | Optional single sign-on; ads on free course videos with consent | Name, Email, Ad identifiers (consented viewers only) | EU/US | DPF + SCCs |
| Microsoft Ireland Operations Ltd Sign in with Microsoft (Entra ID) | Optional single sign-on | Name, Email, Tenant ID | EU Data Boundary | None (EU Data Boundary); DPF |
| Stripe Payments Europe Ltd Payments and payouts | Card payments, subscriptions, expert payouts (Stripe Connect) | Name, Email, Billing address, Payment data (held by Stripe only) | EU (Ireland) with US processing | DPF + SCCs |
| Twilio Ireland Ltd SMS | Vault PINs, breach-clock and security SMS | Mobile number, Message text (PIN or alert, no content) | EU/US | Binding Corporate Rules + SCCs |
| Xero (UK) Ltd Accounting | Invoices and payments sync for AuditGlass's own books | Customer name, Billing contact, Invoice lines | EU/UK/AU | SCCs / UK adequacy |
30 days’ notice of any change.
Before a new sub-processor starts handling personal data, we update this page and email every subscriber at least 30 days ahead. If you object on reasonable data protection grounds, tell us at privacy@auditglass.ie within those 30 days. We will try to resolve it; if we can’t, you can end the affected service without penalty. This is set out in our Data Processing Agreement.
Providers outside the EU receive only what they need. Card data stays with Stripe; AI prompts are redacted before they leave AuditGlass. VEN-01 · VEN-03 · PRV-08
