Sub-processors
List of Sub-Processors:
A sub-processor is any business or contractor where customer data may pass through as a result of using Obrizum’s services, under the GDPR.
This list outlines the partners that we are affiliated with that are utilized to bring specific expertise to our business processes that are critical to our clients having a quality experience.
Used in the core Obrizum system:
| Sub-processor | How it is used | Where data is processed |
|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure for our Apps and Services. Utilizes a single-stack environment for the client | UK / EU |
| Posthog | General usage and product analytics – including but not limited to the provision of testing, support, product development, service improvement, benchmarking and troubleshooting activities on behalf of the Data Controller | EU |
| Sentry | Collects logs and error reports from the live platform, which may include user data | US (transitioning to EU) |
| Flowmailer | Sends transactional emails to customers, including account confirmations and notifications | EU |
| Twilio-Sendgrid | Sends transactional emails to US users, including account confirmations and notifications | US |
| Cookiebot | Collects and processes IP addresses to manage user consents | EU |
| CK Source | CK Editor used in our content management tool to create knowledge space overviews and create HTML nodes | US by default, transitioning to EU |
| Hugging Face | Hosts machine learning models; processes company-provided learning data. This will be migrated to a self-hosted service within AWS over the next few months | UK |
| Adobe | AWS marketplace service to extract text from pdf documents. Processing is handled via Adobe | UK |
| Atlassian | Use Jira for issue reporting and tracking may contain user ID, Knowledge Space names and content titles | EU |
| Slack | Collaboration/alerting tool for issues on the platform | US by default, transitioning to UK |
| Zendesk | Handles customer support inquiries, which may include processing customer personal data (e.g. emails, support tickets). Users may share content issues | EU |
Used in Content Development, Delivery, Support and Broader Business Operations:
| Sub-processor | How it is used | Where data is processed |
|---|---|---|
| Partner Hero | Tech support: Back-office support team based in the Philippines; handles customer requests via Zendesk |
EU (Zendesk), accessed from the Philippines |
| OpenAI (Chat GPT Enterprise) | Content creation: AI content creation. Note: the system is set up such that the model does not learn from content shared |
US |
| Anthropic – Claude | Content creation: AI content creation. Note: the system is set up such that the model does not learn from content shared |
US |
| BlackMagic Cloud | Content creation: Part of the video editing process |
EU |
| Adobe Frame.io | Content creation: Used for customer collaboration on video content |
US (exploring moving it to UK) |
| Asana | Delivery: Project and task management software for building the knowledge spaces |
US by default, transitioning to EU |
| Microsoft 365 | Delivery: Files shared by clients on SharePoint; use of Editor for content etc. |
US |
| HBP Group | Business Operations: Outsourced Cybersecurity and IT Consultancy team; admin rights to our Microsoft accounts |
UK |
Obrizum’s needs as an organization will continue to evolve in light of changes to our business, technical, and regulatory context. As a result we must regularly re-evaluate our Sub-Processor relationships to ensure efficiency in our delivery and development of services. We will regularly update this page to reflect changes to our engagement of external Sub-Processors. Details provided will be balanced between clarifying our data processing architecture and protecting our organizational Information Security. New Sub-Processor relationships will only be entered into after due diligence is performed and regulatory compliance is ensured.
We understand that our Data Subjects have an interest in knowing exactly how their data is processed and will do our best to responsibly facilitate such insights where possible and when requested. Under the terms of our Data Processing Agreement (DPA), a User may reasonably object in writing to the processing of its personal data by a new Sub-Processor within 30 days following the update of this page. If the objection satisfies all relevant Right of Access/Rectification/Erasure/Transportation factors of applicable data protection law, we will facilitate the request. If a User does not object during the 30-day time period, the appointment of the new sub-processor shall be deemed accepted by the User. If you are an Obrizum User and want to know more about our DPA, please contact us.
For more information on Obrizum’s privacy practices, please visit our Privacy Policy. If you have any questions regarding this page, please contact us.
