Sub-processor Register

This register names every third party that ZeroRisk Labs relies on to process personal data, the role it performs, the categories of data that reach it, and the contractual safeguard we rely upon.

It exists because Article 28(3)(d) of the UK and EU GDPR gives a controller the right to object to a change of sub-processor. That right cannot be exercised against a party that has not been named, so a general authorisation to appoint sub-processors is only meaningful alongside a published list. The register forms Annex 3 to our Data Processing Agreement.

We name the entities, their role, and the safeguard. We do not publish cloud region identifiers, project or account identifiers, datastore structure, tooling inventories, or control parameters.

That is a considered decision rather than an omission. Publishing an infrastructure map would give an attacker a target list while adding nothing to a controller's ability to assess our processing chain. Specific processing regions are recorded in the engagement agreement, which is where Article 30(2)(b) of the Digital Operational Resilience Act requires them to appear, and are provided to clients on request under a non-disclosure agreement.

Our own operations are conducted from India. Our sub-processors are global providers that may process data in more than one jurisdiction in the course of delivering platform-level functions such as content delivery and mail routing. The specific processing regions applicable to an engagement are recorded in the engagement agreement and are available to clients on request.

• Notice is sent by email to the contact named in the engagement agreement. We do not rely on publication to this page alone, because a controller cannot be expected to poll a webpage to discover a change affecting its own compliance position.
• Clients may subscribe an additional address — a privacy team inbox or a distribution list — by writing to us with the subject line below.
• A controller may object on reasonable data protection grounds within the notice period. The consequences of an objection, including termination without penalty where no accommodation is possible, are set out in clause 8 of our Data Processing Agreement.
• This page shows its own register version and last-updated date at the top, versioned independently of our other legal documents. A register that shared the document-set version could not signal its own changes, which would defeat the control it exists to provide.

For completeness, and because vendor assessments frequently ask: the following do not appear above because they do not process personal data on our behalf.

• Analytics and advertising platforms — we use none. This website sets no analytics, advertising, or profiling cookies and loads no third-party analytics or advertising scripts.
• Third-party fonts — typefaces are compiled into the site at build time and served from our own origin, so no font request is made to a third party when you visit.
• Content delivery for images — all images on this site are served from our own origin.
• Customer support, chat, and marketing automation tooling — we operate none.

• We assess the necessity of the processing first, and do not appoint a sub-processor where the function can reasonably be performed without one.
• We review the provider's data protection terms, including whether it offers a processor addendum incorporating a valid transfer mechanism.
• We review its security posture and assurance position, including any independent certification it holds.
• We confirm that the obligations we owe our clients can be flowed down contractually in equivalent form.
• We record the assessment, so that it can be produced during a client audit under clause 13 of our Data Processing Agreement.

To add an address to our sub-processor change notification list, or to request the processing regions and detailed assurance material applicable to your engagement, contact us using the subject line below.