1. How we use subprocessors
Kogniflow uses selected subprocessors to deliver and operate the Service, including providers of cloud infrastructure and artificial intelligence. Personal data is processed only to the extent necessary to provide the relevant functionality and is subject to contractual requirements for security, confidentiality, and privacy. The Data Processing Agreement sets out the restrictions on using Customer Personal Data for model training. Details needed to assess the relevant processing can be requested through the contact below.
The providers that apply to a particular Customer depend on the features, integrations, and support channels the Customer uses. A provider's own subprocessor register may change under its agreement with Kogniflow; the linked information is the authoritative source for those onward providers.
2. Current register
Amazon Web Services EMEA SARL
- Purpose
- Core cloud infrastructure, hosting, storage, queues, backups, email delivery, and supporting managed services.
- Relevant processing location
- Primary service region: European Economic Area (Germany). Limited support or service operations may occur in other locations identified by AWS.
- Transfer mechanism
- EEA processing; adequacy decisions and/or the European Commission Standard Contractual Clauses (SCCs) where a restricted transfer applies.
- Provider information
- AWS GDPR Center
OpenAI Ireland Limited
- Purpose
- Artificial-intelligence processing used to provide analysis, generation, and related product functionality.
- Relevant processing location
- Ireland and the processing locations identified in OpenAI's current subprocessor register, which may include countries outside the EEA.
- Transfer mechanism
- Adequacy decisions and/or SCCs, including the controller-to-processor or processor-to-subprocessor module as applicable.
- Provider information
- OpenAI Data Processing Addendum
LlamaIndex, Inc.
- Purpose
- Document parsing and extraction when document-processing functionality is used.
- Relevant processing location
- European Union (Germany) for document storage and processing through the EU endpoint. The contracting provider is a United States entity.
- Transfer mechanism
- EU-region processing; SCCs and supplementary measures where a restricted transfer applies.
- Provider information
- LlamaIndex regions and data residency
Functional Software, Inc. (Sentry)
- Purpose
- Error monitoring, performance diagnostics, and investigation of technical incidents. Content sent to diagnostics is minimized.
- Relevant processing location
- European Economic Area and/or United States, depending on service routing.
- Transfer mechanism
- Adequacy decisions and/or SCCs where a restricted transfer applies.
- Provider information
- Sentry Data Processing Addendum
Plus Five Five, Inc. (Resend)
- Purpose
- Delivery of transactional and service-related email.
- Relevant processing location
- United States; email delivery may also involve recipient mail systems in other countries.
- Transfer mechanism
- SCCs and supplementary measures where required.
- Provider information
- Resend Data Processing Addendum
Intercom R&D Unlimited Company
- Purpose
- In-product customer support, service communications, and support administration.
- Relevant processing location
- Ireland and, depending on the selected service and support flow, other locations listed by Intercom, including the United States.
- Transfer mechanism
- Adequacy decisions and/or SCCs where a restricted transfer applies.
- Provider information
- Intercom Data Processing Agreement
Google Ireland Limited and relevant Google affiliates
- Purpose
- User authentication where a user or organization selects Google sign-in.
- Relevant processing location
- European Economic Area and Google's global processing locations, depending on the authentication and support flow.
- Transfer mechanism
- Adequacy decisions and/or SCCs where a restricted transfer applies.
- Provider information
- Google Privacy Policy
3. Other third-party services
Some services are not subprocessors for all processing. Payment services are provided by Stripe Payments Europe, Limited and relevant Stripe affiliates when billing collection is enabled. Stripe may act as a processor or an independent controller depending on the payment activity; see the Stripe Data Processing Agreement.
Accounting systems, identity services, and other integrations selected by a Customer may receive data at that Customer's direction. Their role depends on the Customer's own relationship with the provider and is not automatically a Kogniflow subprocessor relationship. The Customer is responsible for enabling only integrations it is authorized to use.
4. Changes and objections
Kogniflow will give Customers at least 30 days' notice before a new or replacement subprocessor begins processing Customer Personal Data, normally by email or an in-Service notice. A Customer may object during that period on reasonable data-protection grounds by contacting us. We will work in good faith to address the concern, including by considering a reasonable alternative where available. The rights and process in the Data Processing Agreement apply.
5. Contact
Questions, objections, and requests for more information may be sent to support@kogniflow.com. Please identify the Customer organization and the provider concerned so we can route the request correctly.