GovernSafe Logo
Data processing transparency

GovernSafe Subprocessors

These providers help us run, secure, support, and measure GovernSafe. The list identifies what each provider does, the data involved, and when a service is conditional on a customer-enabled connector.

Last updated:
Listed services
11
Providers
7

Active and conditional subprocessors

“Conditional connector” means the provider processes relevant data only when a customer chooses to connect that platform. Website analytics providers operate on public-site routes, subject to applicable cookie and tracking controls.

11 services listed

Core service

Microsoft Azure

Microsoft Corporation

Primary cloud hosting, compute, container execution, storage, networking, monitoring, and platform operations.

Data categories
Customer account data, connected-cloud metadata, security findings, reports, support logs, and service telemetry.
Processing location
Customer-selected GovernSafe processing region where available; limited global support access under contractual safeguards.
Identity and communications

Microsoft Entra ID and Microsoft 365

Microsoft Corporation

Enterprise authentication, tenant consent, operational email, service notices, and support communications.

Data categories
User and administrator identifiers, tenant identifiers, authentication metadata, and communication details.
Processing location
Microsoft service regions, subject to the customer tenant configuration and applicable transfer safeguards.
Conditional connector

Google Cloud and Google Workspace APIs

Google LLC

Customer-directed Google Workspace connection, workload identity federation, API access, and Google Cloud governance collection.

Data categories
Google administrator identifiers, tenant configuration, directory and audit metadata, cloud asset metadata, and permission evidence.
Processing location
Google service regions; used only when a customer enables the applicable Google connection.
Website and edge security

Cloudflare network and security services

Cloudflare, Inc.

Authoritative DNS, TLS delivery, content delivery, traffic filtering, availability protection, and edge security analytics.

Data categories
IP address, request metadata, browser and device signals, security events, and limited cached web content.
Processing location
Cloudflare global edge network; origin services remain governed by GovernSafe regional controls.
Billing

Stripe Payments and Billing

Stripe, LLC and applicable affiliates

Payment processing, subscription management, invoicing, fraud prevention, and billing support.

Data categories
Billing contact details, payment tokens, transaction records, subscription status, and fraud-prevention signals.
Processing location
Stripe global infrastructure with contractual transfer safeguards. GovernSafe does not store full payment-card details.
Reliability

Sentry

Functional Software, Inc.

Application error reporting, release diagnostics, and performance troubleshooting.

Data categories
Error stack traces, request and device metadata, user identifiers where present, release identifiers, logs, and diagnostic context.
Processing location
European Union for the currently configured Sentry ingestion endpoint.
Interactive media

Spline-hosted interactive scenes

Spline, Inc.

3D product visuals on selected public feature pages. The external scene may load when the page or relevant section is displayed.

Data categories
IP address, browser and device metadata, request details, and interactions sent when the visitor loads the external scene.
Processing location
United States, subject to Spline's service terms and privacy safeguards.
Optional interactive media

YouTube privacy-enhanced embedded video

Google LLC

Optional product-demo video on the public website, loaded only after a visitor chooses to play it.

Data categories
IP address, browser and device metadata, request details, and video interactions sent when the visitor loads the external player.
Processing location
Google global infrastructure with applicable transfer safeguards.
Website analytics

PostHog

PostHog, Inc.

Public-website page and feature analytics, plus session replay used to understand content performance, navigation, and usability.

Data categories
Pseudonymous page paths, approved feature events, public-page interactions and DOM changes, browser metadata, and coarse network information. Form input values are masked in replay.
Processing location
The US or EU PostHog region selected in GovernSafe's production configuration.
Website analytics

Google Analytics and Google Tag Manager

Google LLC

Public-website traffic measurement, campaign attribution, and aggregate content performance reporting.

Data categories
Cookie or device identifiers, page views, interaction events, referral data, and browser or network metadata.
Processing location
Google global infrastructure with applicable transfer safeguards.
Website analytics

Microsoft Clarity

Microsoft Corporation

Public-website interaction analytics used to diagnose navigation and usability issues.

Data categories
Page interactions, session and device identifiers, browser metadata, and network information.
Processing location
Microsoft global infrastructure with applicable transfer safeguards.
Customer-connected platforms

Your cloud provider remains under your control

Microsoft 365, Azure, Google Workspace, Google Cloud, and AWS can also act as customer-directed data sources. When GovernSafe accesses a platform under your organisation's tenant and agreement, that provider is not automatically a GovernSafe-appointed subprocessor for the same activity.

Changes and questions

We keep this register current

GovernSafe updates this page when a material subprocessor changes. Contractual notice and objection rights continue to apply where they are included in a customer agreement or data processing addendum.

Ask a data-processing question

Read this register with our Privacy Policy

The Privacy Policy explains GovernSafe's collection, use, retention, international-transfer, and data-subject practices.

Read the Privacy Policy