How suppliers are chosen and reviewed, and the full list of sub-processors.
01Selection and review
- Suppliers that process customer data are chosen for their security certifications, data location and contractual commitments (GDPR Article 28 terms or equivalent).
- Each supplier receives only the data its function needs. Optional integrations (calendars, Zoom, AI) are switched on by the organisation or the participant.
- Suppliers are reviewed yearly and when their service or terms change. Customers are informed before a new sub-processor of programme data is added.
- Software dependencies are pinned through lock files and scanned for known vulnerabilities (see the Vulnerability and Patch Management Policy).
02Sub-processors
| Supplier | Purpose | Data location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, backups, logs, transactional e-mail (SES) | EU (Frankfurt) |
| Cloudflare | DNS, CDN, DDoS protection, bot checks on public forms, inbound e-mail routing | Global edge network |
| Stripe | Subscription billing and card payments (billing contacts only) | EU and US |
| Optional: Sign in with Google, Google Calendar sync | Per the participant’s Google account | |
| Microsoft | Optional: Sign in with Microsoft, Outlook calendar sync | Per the participant’s Microsoft account |
| Zoom | Optional: Zoom meeting links | Per the organisation’s Zoom account |
| Anthropic | Optional: Mentornity AI assistant, with the organisation’s own API key | US |
Source code hosting (GitHub) and uptime monitoring hold no programme data.
03Contact
Questions about this policy, security questionnaires and Data Processing Agreement requests: privacy@mentornity.com.