Trust
Sub-processors
The third parties that may process personal data on our behalf. Last updated 21 August 2026.
A sub-processor is a third party we engage to process personal data on behalf of our customers, or on our own behalf for this website. We contract each one under written terms no less protective than our own commitments, and we remain responsible to you for their performance.
Website and marketing
These providers process visitor and prospect data for automentic.com. They do not process Customer Content from the Automentic platform.
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services, Inc. | Website hosting and server logs | Australia (Sydney, ap-southeast-2) | Primary processing in Australia. AWS GDPR Data Processing Addendum; Standard Contractual Clauses (2021) and UK International Data Transfer Addendum for any limited overseas support access. |
| Cloudflare, Inc. | Content delivery, DNS, WAF and bot mitigation | Global edge network (nearest PoP, including Australia); United States parent | Cloudflare Data Processing Addendum; EU–US Data Privacy Framework and Standard Contractual Clauses (2021) with UK Addendum. |
| HubSpot, Inc. | Storage of demo requests and sales correspondence | European Union (Frankfurt) or Australia, selected at account creation | HubSpot Data Processing Agreement; intra-EEA processing where EU hosting is selected; EU–US Data Privacy Framework and Standard Contractual Clauses (2021) with UK Addendum for any US support or sub-processors. |
| Google LLC (Google Workspace) | Business and sales email for @automentic.com | Australia data region | Google Cloud Data Processing Addendum; primary processing in Australia; Standard Contractual Clauses (2021) and EU–US Data Privacy Framework where Google processes data outside Australia. |
| Plausible Insights OÜ | Aggregate website measurement, cookieless, consent-gated | European Union (Germany; Estonian controller) | Processing inside the EEA; no restricted transfer of analytics data outside the Union. |
Platform
These providers may process Customer Content to run the Automentic service. They do not include the website and marketing vendors. Audit records stay in the region the customer selects.
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services, Inc. | Compute, storage, networking, key management and region-pinned audit log storage for the Automentic platform | Customer-selectable: Australia (Sydney, ap-southeast-2), EU (Frankfurt, eu-central-1), UK (London, eu-west-2); US only if the customer opts in | Processing in the selected region. AWS GDPR Data Processing Addendum; Standard Contractual Clauses (2021) and UK International Data Transfer Addendum for any limited overseas support access. |
| Amazon Web Services, Inc. (CloudWatch, CloudTrail and S3) | Operational telemetry and immutable audit log storage in the same region as the customer workspace. Product audit trails are not shipped to a separate observability vendor. | Same regions as above | As for AWS above. Audit records stay in the region the customer selects unless agreed otherwise in writing. |
| Grafana Labs (Raintank, Inc.) | Control-plane monitoring for Automentic-operated infrastructure only (availability, latency, error rates). Does not receive Customer Content or signed action payloads. | European Union or Australia stack, selected at onboarding | Grafana Cloud Data Processing Addendum; Standard Contractual Clauses (2021) with UK Addendum where the stack is outside the customer’s region. |
| Zendesk, Inc. | Customer support ticketing. Tickets may contain Customer Content a customer pastes into a request. AI assist and attachment-training features remain off unless a customer contract says otherwise. | European Union data centre (primary); United States parent | Zendesk Data Processing Agreement; EU–US Data Privacy Framework and Standard Contractual Clauses (2021) with UK Addendum. |
How we manage sub-processors
Before engaging a sub-processor we assess its security posture, its certifications, where it processes data, and the transfer mechanism relied upon. Each is bound by a written contract containing data protection terms, confidentiality obligations and, where required, Standard Contractual Clauses.
Notice of changes
We will publish planned additions or replacements on this page at least 30 days before the new sub-processor begins processing. Customers with a signed Data Processing Agreement may subscribe to change notifications and may object to a new sub-processor on reasonable data protection grounds, as set out in that agreement.
To subscribe to changes, email privacy@automentic.com.
Related
See our Privacy Policy for how we handle personal data, and the Data Processing Agreement for the contractual terms that govern platform processing.
Get notified of changes
Email privacy@automentic.com and we will tell you before a new sub-processor starts processing.