Subprocessors & Technology Providers

1. How to Read This List

The providers listed below support different parts of the Secusy platform and ValueMentor's service delivery.

Not every provider is used for every Customer or Service.

The providers that process Customer Personal Data may depend on factors including:

• the Service purchased;
• Platform features used;
• selected hosting environment;
• Customer location;
• required data residency;
• integrations enabled;
• payment method; and
• whether AI-enabled functionality is used.

Where ValueMentor processes Personal Data on behalf of a Customer as a processor, third parties engaged to process that Personal Data on our behalf may act as subprocessors as described in the applicable Data Processing Agreement ("DPA").

Some providers may instead act as independent controllers or provide technology that does not involve processing Customer Personal Data as a subprocessor.

2. Platform, Hosting and Infrastructure Providers

Vercel

Purpose: Secusy website and application hosting, deployment, content delivery and supporting infrastructure.

Data potentially processed: Website and Platform requests, IP addresses, device and technical information, application traffic, diagnostic information and other information transmitted through hosted Secusy functionality.

Usage: Used to operate and deliver the Secusy web application.

Amazon Web Services (AWS)

Purpose: Cloud infrastructure, hosting, storage, computing and cybersecurity service delivery.

Data potentially processed: Customer Content, account or technical information, logs, security data, assessment information and other information required for the applicable Service.

Usage: Used where AWS hosts or supports the relevant Secusy or ValueMentor service workload.

The applicable region may depend on the Service, Customer requirements and available hosting options.

Microsoft Azure

Purpose: Cloud infrastructure, hosting, storage, computing and cybersecurity service delivery.

Data potentially processed: Customer Content, account or technical information, logs, security data, assessment information and other information required for the applicable Service.

Usage: Used where Azure hosts or supports the relevant Secusy or ValueMentor service workload.

The applicable region may depend on the Service, Customer requirements and available hosting options.

Google Cloud

Purpose: Cloud infrastructure, hosting, storage, computing and supporting technology services.

Data potentially processed: Customer Content, technical information, security data and other information required for the applicable workload or Service.

Usage: Used where Google Cloud hosts or supports the relevant workload.

DigitalOcean

Purpose: Cloud hosting, computing and infrastructure services.

Data potentially processed: Customer Content, technical information, application data, logs and other information required for workloads hosted on DigitalOcean.

Usage: Used for selected workloads and Services.

3. Authentication

Clerk

Purpose: User authentication, identity management and Secusy account access.

Data potentially processed: Name, email address, user identifiers, authentication information, session information, IP address, device information and related account-security information.

Usage: Used to authenticate and manage access to Secusy accounts.

4. Payments

Stripe

Purpose: Payment processing, checkout, transaction management, fraud prevention and related payment services.

Data potentially processed: Name, business information, billing information, payment information, transaction information, IP address and related payment or fraud-prevention information.

Usage: Used for supported online payments and subscription billing.

Stripe may act as an independent controller for certain payment-processing activities and as a processor or service provider for others, depending on the relevant processing activity.

5. Analytics and Website Experience

The following providers are used subject to applicable cookie and consent requirements.

Google Analytics

Provider: Google

Purpose: Website analytics, traffic measurement and understanding how visitors use Secusy.

Data potentially processed: Online identifiers, IP and device information, browser information, website interactions, referral information and usage information.

Usage: Used only in accordance with the applicable cookie-consent choices and our Cookie Policy.

Hotjar

Purpose: Website analytics, interaction analysis and usability improvement.

Data potentially processed: Device and browser information, website interactions, navigation behaviour, clicks, scrolling and other usage information depending on configuration.

Usage: Used only in accordance with the applicable cookie-consent choices and our Cookie Policy.

We configure analytics and experience technologies with the intention of avoiding the intentional collection of passwords, payment-card information, Customer credentials and Customer security evidence.

6. Business Communications and Customer Relationship Management

Microsoft 365

Provider: Microsoft

Purpose: Business email, communications, document collaboration and productivity services.

Data potentially processed: Names, email addresses, communications, attachments, business contact information and information exchanged with ValueMentor in connection with the Customer relationship or Service delivery.

Zoho CRM

Provider: Zoho

Purpose: Customer relationship management, sales administration, account management and business communications.

Data potentially processed: Names, business contact information, organisation information, sales and Customer relationship information, Service interests, communications and related account information.

7. Artificial Intelligence and Model Providers

Secusy may use third-party artificial intelligence and machine-learning providers to support selected Platform features and Service-delivery activities.

The provider used may depend on the particular Secusy feature or Service.

Anthropic — Claude

Purpose: AI-assisted analysis, summarisation, classification, generation, workflow support and other AI-enabled Secusy or Service functionality.

Data potentially processed: Information submitted to or generated by an AI-enabled feature, subject to the configuration and purpose of that feature.

OpenAI — ChatGPT / OpenAI Models

Purpose: AI-assisted analysis, summarisation, classification, generation, workflow support and other AI-enabled Secusy or Service functionality.

Data potentially processed: Information submitted to or generated by an AI-enabled feature, subject to the configuration and purpose of that feature.

Google — Gemini

Purpose: AI-assisted analysis, summarisation, classification, generation, workflow support and other AI-enabled Secusy or Service functionality.

Data potentially processed: Information submitted to or generated by an AI-enabled feature, subject to the configuration and purpose of that feature.

8. Our Approach to Customer Data and AI

Use of an AI provider does not mean that all Customer Content is shared with that provider.

Information is provided to AI services only where required for the relevant functionality or Service and subject to applicable contractual, privacy and security controls.

ValueMentor does not use Customer Content containing identifiable personal information, credentials, identifiable confidential documents or identifiable Customer-specific security findings to train general-purpose AI models unless separately agreed with the Customer.

ValueMentor may use aggregated or effectively anonymised information that no longer identifies an individual or Customer for purposes including:

• improving Secusy;
• cybersecurity research;
• statistical analysis;
• benchmarking;
• improving security and assessment capabilities; and
• developing or improving machine-learning and AI capabilities,

subject to applicable law and our Privacy Policy.

9. International Processing and Data Transfers

Some providers listed on this page operate internationally or may process information outside the United Kingdom.

Where ValueMentor acts as controller and a restricted transfer of Personal Data occurs, we use an appropriate transfer mechanism where required by applicable data-protection law.

Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses; or
• another lawful transfer mechanism.

Where ValueMentor acts as processor on behalf of a Customer, international transfers and subprocessors are governed by the applicable DPA.

10. Data Residency

The location in which Customer data is hosted may depend upon the Service purchased and the infrastructure used to provide that Service.

Where a Service expressly includes a specific data-residency commitment, hosting region or in-country hosting requirement, that commitment will be stated in the applicable Order, Service Terms or other contractual documentation.

The inclusion of a cloud provider on this page does not mean that Customer data is stored with every listed provider.

11. Security and Confidentiality

ValueMentor evaluates third-party providers based on factors relevant to their role, which may include security, privacy, confidentiality, contractual protections, service capabilities and regulatory requirements.

Access to Customer information is limited according to the provider's purpose and the applicable Service configuration.

Our use of subprocessors does not remove ValueMentor's obligations to Customers under the applicable agreement or DPA.

12. Changes to Subprocessors

Our technology and service-delivery infrastructure may change over time.

We may add, replace or discontinue providers as our Services evolve.

Where ValueMentor acts as processor and the applicable DPA requires notification of new subprocessors, we will provide notification in accordance with that DPA and any applicable objection procedure.

The current list of providers will be maintained on this page.

Customers that require contractual subprocessor notifications should follow the notification process specified in the applicable DPA.

13. Questions

For questions concerning subprocessors, international transfers or how a particular Secusy Service processes Personal Data, contact:

privacy@valuementor.com