Sub-processors
Last updated: Version: 1.0The Spanish version is the legally binding text.
The Spanish version of this document is the legally binding text. This translation is provided for reference only.
This is the list of sub-processors referred to in clause 7.1 and Annex 1 of the Data Processing Addendum (DPA). It includes the third parties that may process personal data on behalf of our clients when we provide the services. The providers involved in running this website are described in the Personal Data Processing Policy.
| Sub-processor | Service | Server location |
|---|---|---|
| Google LLC (Google Cloud) | Cloud infrastructure, databases and compute for hosted services | United States and the Google Cloud regions configured for each service |
| Microsoft Corporation (Microsoft Azure) | Cloud infrastructure and compute for hosted services | United States and the Azure regions configured for each service |
| GitHub, Inc. | Repositories and continuous integration and delivery workflows in the Provider’s organisations | United States |
| Anthropic, PBC | Artificial intelligence models, when access to the model is provided by the Provider | United States |
| OpenAI OpCo, LLC | Artificial intelligence models, when access to the model is provided by the Provider | United States |
| Microsoft Corporation and Google LLC | Corporate email and collaboration (Microsoft 365, with a planned migration to Google Workspace) | United States and other countries |
When each one is involved. Not every sub-processor takes part in every service: it depends on the services contracted and the configuration agreed in each Service Order. For example, artificial intelligence model providers only process data when access to the model is provided by Greyfield Strata.
Platforms contracted by the client. Platforms the client contracts directly, such as its own GitHub organisation or its model provider when it uses its own credentials, are not sub-processors of Greyfield Strata. The processing relationship with those third parties exists directly between them and the client (DPA, clause 7.3).
Changes. We will give thirty (30) calendar days’ notice of any addition or replacement of sub-processors, and the client may object on reasonable grounds related to data protection, under clause 7.2 of the DPA. Each change is published here with a new date and version number.