Sub-processor List
Version 2.0 · Published 26 August 2026
About this page
This page lists the sub-processors we engage to deliver the Insightology Platform. It covers third parties that process customer personal data on our behalf. No sub-processor is permitted to use customer data to train its own models.
How this list changes
We select the AI model best suited to each stage of the research workflow, and we expect that selection to change as models improve. The tables below name the full set of organisations we may engage, not only the ones in use today.
Moving between organisations already named on this page is not the addition of a new sub-processor. They are approved under the Agreement from the outset. Where we make such a change we record it in the change log at the end of this page and notify our customers in writing at the same time, in accordance with their Agreement.
We will not engage an organisation that is not named on this page without giving prior written notice in accordance with the Agreement, during which a customer may object on reasonable grounds. Where a change originates further down the supply chain, in the systems of one of our own sub-processors, we pass on notice as soon as reasonably practicable after we receive it.
Platform sub-processors
| Sub-processor | Service provided | Personal data processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Google Cloud EMEA Limited | Hosting, authentication, database, file storage, secret management, compute and bot protection. Firebase Hosting, Firebase Authentication, Firestore, Cloud Storage, Secret Manager, Cloud Run, reCAPTCHA | All customer data uploaded to or generated by the Platform, and authorised user account data | The customer's assigned home region: European Union or United States | EU home region: UK adequacy regulations for the EEA. US home region: UK International Data Transfer Addendum to the EU SCCs |
| PostHog Inc. | Product analytics and error monitoring | Authorised user identifiers, usage events and technical data | European Union (Frankfurt, Germany), with limited international processing as described in PostHog's DPA | UK International Data Transfer Addendum to the EU SCCs. PostHog Inc. is self-certified to the EU-US Data Privacy Framework and its UK Extension |
| Vanta Inc. | Continuous security and compliance control monitoring | Staff account and device metadata, and evidence of control operation. No customer research content | United States | UK International Data Transfer Addendum to the EU SCCs |
AI model providers
Insightology uses a range of AI model providers and cloud hosting platforms. The provider used may vary depending on the model, customer configuration and service requirements.
| Organisation | Service provided | Personal data processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Google Cloud EMEA Limited | Cloud hosting, authentication, database, file storage, compute and other services, including Firebase, Google Cloud and Vertex AI | Customer data uploaded to or generated by the Platform, authorised user account data and customer content processed through applicable AI services | European Union or United States, depending on customer and deployment configuration | UK adequacy regulations for EEA processing; EU Standard Contractual Clauses plus the UK International Data Transfer Addendum for transfers to non-adequate countries |
| Microsoft Ireland Operations Limited | Hosting and processing, including Microsoft Azure Foundry | Customer content submitted for processing via Microsoft Azure services | European Union, United States or other supported Azure regions, depending on deployment configuration | UK adequacy regulations for EEA processing; EU Standard Contractual Clauses plus the UK International Data Transfer Addendum for transfers to non-adequate countries |
| Amazon Web Services, Inc. | Hosting and processing, including Amazon Bedrock | Customer content submitted for processing where AWS services are used | European Union, United States or other supported AWS regions, depending on deployment configuration | UK adequacy regulations for EEA processing; EU Standard Contractual Clauses plus the UK International Data Transfer Addendum for transfers to non-adequate countries |
| Anthropic PBC | AI model services | Customer content submitted for AI processing where Anthropic services are accessed directly | European Union and United States | Standard Contractual Clauses plus the UK International Data Transfer Addendum |
| OpenAI, L.L.C. | AI model services | Customer content submitted for AI processing where OpenAI services are accessed directly | United States | EU Standard Contractual Clauses as supplemented by the UK International Data Transfer Addendum |
Change log
Customers receive written notice before any change takes effect, in accordance with their agreement.
- Version 2.0 — published 26 August 2026. Updated the list of sub-processors and revised how AI model providers are described.
- Version 1.0 — initial published list.
Contact
Questions about this page: privacy@insightology.ai