Sub-processors

This is the full, up-to-date list of sub-processors that process personal data on behalf of our customers. The list is the current version under clause 5.2 of the data processing agreement.

Last updated March 20266 sub-processors

How changes are notified

When we add or replace a sub-processor, the change is published on this page. The customer may, within thirty days of publication, raise objectively justified objections. If the parties fail to reach agreement, the customer may terminate the contract with effect from the date the new sub-processor was to be taken into use. Continued use of the service after the deadline is deemed acceptance.

Want to be notified by email as well? Let us know – we'll add you to the list. Note that email notice is an addition, not a condition for the change to be valid. Let us know

Approved sub-processors

SupplierService / roleLocationDescription of the processing

MicrosoftHosting (Azure) and admin (365)

EEA

Storage and processing of application data, email, video conferencing, databases, backup, operations and monitoring.

FrontedIT consultancy

EEA

Provides full-time software developers who assist AIMZ with software development.

HubSpotCRM

EEA

Administration of customer users and contacts, and activity patterns for follow-up, onboarding and health indicators.

PostHogProduct analytics

EEA

Events and user behaviour, pseudonymous identifiers and technical metadata for analysis and product improvement.

IntercomCustomer support and chat

USA

Name, email, enquiry content and technical metadata for customer support related to the solution.

Transfer basis: EU Standard Contractual Clauses (SCC 2021/914) with a completed Transfer Impact Assessment. Deletion or return on request under clause 9 of the Data Processing Agreement.

OpenAIProduct enrichment

USA

Analysis and generation of suggestions. AI features aren't trained on customer data unless specifically agreed in writing.

Transfer basis: EU Standard Contractual Clauses (SCC 2021/914) with a completed Transfer Impact Assessment. Deletion or return on request under clause 9 of the Data Processing Agreement.

Change log

The publication date is the starting point for the customer's thirty-day window to raise objections.

PublishedTypeChange

March 2026BaselineFirst published version of the list, corresponding to Annex B of the data processing agreement dated March 2026.

Data processing agreement

The agreement the list belongs to

Trust Center

Security and privacy in one place