Sub-processors

This is the full, up-to-date list of sub-processors that process personal data on behalf of our customers. The list is the current version under clause 5.2 of the data processing agreement.

Last updated October 20266 sub-processors
How changes are notified

When we add or replace a sub-processor, the change is published on this page. The customer may, within thirty days of publication, raise objectively justified objections. If the parties fail to reach agreement, the customer may terminate the contract with effect from the date the new sub-processor was to be taken into use. Continued use of the service after the deadline is deemed acceptance.

Want to be notified by email as well? Let us know – we'll add you to the list. Note that email notice is an addition, not a condition for the change to be valid. Let us know

Approved sub-processors

SupplierService / roleLocationDescription of the processing
MicrosoftHosting (Azure) and admin (365)
EEA
Storage and processing of application data, email, video conferencing, databases, backup, operations and monitoring.
FrontedIT consultancy
EEA
Provides full-time software developers who assist AIMZ with software development.
HubSpotCRM
EEA
Administration of the solution's users and contacts, and usage patterns for onboarding, user support and follow-up of the use of the solution.
PostHogProduct analytics
EEA
Events and user behaviour, pseudonymous identifiers and technical metadata for operation, analysis and improvement of the solution.
IntercomCustomer support and chat
USA
Name, email, enquiry content and technical metadata for customer support related to the solution.
Transfer basis: EU Standard Contractual Clauses (SCC 2021/914) with a completed Transfer Impact Assessment. Deletion or return on request under clause 9 of the Data Processing Agreement.
OpenAIProduct enrichment
USA
Analysis and generation of suggestions. Models aren't trained on personal data, and customer data is only used for training in anonymised and/or aggregated form.
Transfer basis: EU Standard Contractual Clauses (SCC 2021/914) with a completed Transfer Impact Assessment. Deletion or return on request under clause 9 of the Data Processing Agreement.

Change log

The publication date is the starting point for the customer's thirty-day window to raise objections.

PublishedTypeChange
October 2026UpdatedNo new sub-processors. The descriptions of HubSpot and PostHog now specify processing for the solution (data processing agreement, October 2026).
March 2026BaselineFirst published version of the list, corresponding to Annex B of the data processing agreement dated March 2026.