Legal · Sub-processors
Sub-processor list.
Every vendor that can access customer data, with its region and purpose. The list is dated, and customers are notified before it changes.
01The list
| Vendor | Purpose | Data it can touch | Region |
|---|---|---|---|
| Auth0 (Okta, Inc.) | Sign-in: authentication, password handling, MFA, breach detection. | Account identities — name, email, sign-in identifiers. Never monitoring records. | Tenant region chosen at deployment (AU available). |
| Hosting provider | Runs the hosted demo site and, where a customer chooses hosted deployment, the application. | Whatever the deployment holds — encrypted at rest on the host's disks. | Chosen per deployment; confirmed in the deployment overview. |
| FormSubmit | Relays messages from this website's contact form to our inbox. | What a visitor types into the form — name, company, email, message. Never product data. | Service-hosted (outside AU). |
NO AI PROVIDERS — the product currently makes no AI model calls, so no customer data reaches any model vendor. If that changes, this list and an AI transparency statement are updated first, with notice.
02Self-hosted deployments
When REQOPS runs on your own infrastructure — the standard deployment — customer records never reach a sub-processor of ours at all. The only entry that still applies is Auth0, for sign-in identities. Your own cloud account or hardware is yours, not a sub-processor.
03How changes work
- Vetting first. Any vendor that would touch customer data gets full due diligence — security reports, DPA, breach history — before use, with the decision recorded.
- Notice before the change. We tell customers before this list changes, and you can object before it does.
- Flow-down. The commitments we make to you — confidentiality, breach notice, deletion — are written into our contracts with them.
- Reviewed quarterly, dated each time, alongside the vendor files.
To be notified of changes, or to see a vendor's due-diligence file under NDA: hello@reqops.io. Related: privacy · how vendors are vetted.