Sub-processors
Ciso99.AI engages the third parties below to help deliver its services. Each is bound by a written data processing agreement with confidentiality and security obligations at least as protective as those we owe our customers, undergoes security due diligence and risk assessment before engagement, and may process customer data only on our documented instructions. Ciso99.AI remains fully responsible to its customers for its sub-processors' performance.
We do not sell customer data, and we do not share it for cross-context behavioral advertising.
Platform
Providers involved in operating the Ciso99.AI platform.
| Sub-processor | Why we use it | What it processes | Location |
|---|---|---|---|
| Google Cloud Platform | Infrastructure — we do not run our own data centres. | Hosts the entire platform: application compute, the tenant database, and file storage. All customer data we retain is stored here, encrypted at rest. | europe-west3(Frankfurt, EU) |
| Google Cloud Vertex AI | Model inference — findings are summarized and remediation drafted by a language model rather than hand-written. | Receives only the specific content needed for a given request, as input for that request alone. Not retained by the provider and never used for model training. | Global (see note) |
| Anthropic | Model inference — same purpose, for the models we run on Anthropic's API. | Receives only the content needed for a given request, under contractual terms prohibiting retention for model training. | United States |
| Slack Technologies | Delivery — reviews and findings are conducted in the customer's own Slack, not in a separate console the reviewer must log into. | Where a customer has connected Slack, receives the review requests, findings, and campaign messages we send into their own workspace. Reviewers make their access decisions there, so the content of those cards passes through Slack. | United States |
| Descope | Authentication — we do not build or store our own password infrastructure. | Authenticates users signing in to the Ciso99.AI console. Receives names, email addresses, and authentication metadata only — never data from a customer's connected systems. | United States |
Note on inference location. Platform storage and compute run in the EU. Model inference currently runs at a global endpoint, so content sent to a model for processing is not pinned to the EU.
Website
Providers involved in operating ciso99.ai. These receive enquiry and visitor data only — they never receive data from a customer's connected systems.
| Sub-processor | Why we use it | What it processes | Location |
|---|---|---|---|
| Google reCAPTCHA | Abuse prevention — the contact form is public and would otherwise be spammed. | Visitor IP address and interaction signals. | United States |
| Formspree | Form handling — the website is static and cannot process a form submission itself. | Every field submitted through the contact form, before it reaches us. | United States |
| HubSpot | Customer relationship management and email marketing — we do not run our own CRM or mailing infrastructure. | Enquiry and contact details submitted through the website, and the name and email address of anyone who opts in to our mailing list. | United States |
Other recipients
Beyond the sub-processors above, data may reach:
- Your own organization — authorized administrators and users within your tenant, according to the role-based permissions you configure.
- Legal and regulatory recipients — where disclosure is required by applicable law, legal process, or to protect rights and safety. We notify you where legally permitted.
Changes to this list
We revise this page whenever we add or replace a sub-processor, and we notify customers in advance of material changes. The "Last updated" date at the top reflects the current version. Customers who would like advance notice of changes can request it at privacy@ciso99.ai.