Current sub-processors
These providers process customer data on our behalf in the course of providing the ISOvault service, under our Data Processing Agreement.
| Sub-processor | Purpose | Data processed | Processing location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure: databases, document storage, backups, email delivery, background processing and AI processing (Claude models via Amazon Bedrock) | All customer data and documents, including content submitted to AI features | United Kingdom (London, eu-west-2) | UK processing; AWS UK GDPR data processing terms |
| Vercel Inc. | Application hosting and delivery of the ISOvault web application | Customer data in transit through the application | United Kingdom (London region); Vercel Inc. is a US company | UK Addendum to EU SCCs / UK IDTA; EU-US Data Privacy Framework |
| Auth0 (Okta, Inc.) | Authentication, single sign-on and multi-factor authentication | User names, email addresses, login records | European Union; Okta, Inc. is a US company | UK Addendum to EU SCCs / UK IDTA; EU-US Data Privacy Framework |
Providers that are not sub-processors
For completeness, two categories of provider are deliberately absent from the table above:
- Stripe handles our payment processing and billing. Stripe processes billing data on our behalf as our own processor, and processes payment and card data as an independent controller for payment services, fraud prevention and financial compliance. It never touches the content of your ISMS, so it is not a sub-processor of customer data under our DPA. Details are in our privacy policy.
- Website analytics. Our marketing website uses cookie-free, aggregate analytics that does not collect personal data, so the provider does not appear in this register. If that ever changes, the register will be updated first.
How changes are notified
We will update this page and notify account holders by email at least 30 days before adding or replacing a sub-processor that processes customer personal data. Customers may object on reasonable data protection grounds as set out in clause 5 of the DPA.
Why so few? ISOvault is deliberately focused software with a deliberately short supply chain. Every provider on this list is load-bearing: infrastructure, application delivery, identity. AI processing happens inside our AWS environment in London (Claude models via Amazon Bedrock), so your ISMS content is never sent to an AI company. There are no advertising tools, no tracking pixels and no data enrichment services, and there never will be.
Questions
If your supplier assessment needs more detail on any provider listed here, email hello.isovault@agentmail.to and we will complete your questionnaire.