Subprocessors

What a subprocessor is here

A subprocessor is a third party we engage that processes personal data on our behalf in order to provide Badgewright to you. Each is bound by a written contract with data protection terms no weaker than the ones in our data processing addendum, and we remain responsible to you for what they do.

This page is the authoritative list. It was last changed on the effective date at the top.

Infrastructure

Google Cloud is the only place Customer Data is stored. The database, the photographs and the backups are all in the same region, and nothing is replicated outside the United States.

Service providers

Stripe is marked because billing is not built yet. It will take payments from the day subscriptions open, and it is listed now rather than added quietly later.

Google Analytics is used under the Google Ads Data Processing Terms, with data sharing with other Google products switched off, Google signals off and advertising personalisation off. What it processes on the website is described in section 4 of the privacy policy.

Not in the table, because it is not engaged to process anything in the course of providing the Service and nothing reaches it in the ordinary course: we build and operate Badgewright with AI-assisted engineering tools from Anthropic. When we investigate a sign-in, an account or an incident, the account details involved, such as an email address or an IP address, may be processed by that tool, under terms that prohibit training on them. No record, photograph or other Customer Data is ever sent to it.

Things that are not subprocessors

Google and Microsoft, as sign-in providers

Where a Google or Microsoft sign-in is offered and a user chooses it, that exchange happens between them and the provider under the provider's own terms. We receive an identifier and an email address. They are not processing data on our behalf, and neither is used unless it is offered and a user picks it.

Have I Been Pwned

Checked when somebody sets a password, so a known-breached one can be refused. It receives the first five characters of a SHA-1 hash and nothing else, which is not personal data and cannot be tied to a person or an account. Listed here for completeness rather than because it processes anything.

Your card printer and its driver

Printing happens from your browser to a printer on your own network. Card data does not travel through us to get there, and it does not travel to the printer manufacturer.

What we do not use, and will not without telling you

There is no:

• analytics inside the application, of any kind. Google Analytics runs on this website only: the app loads no third-party script, sets no analytics cookie, and sends nothing to Google;
• advertising network, retargeting pixel or data broker, of any kind, ever;
• third-party support desk, live chat widget or CRM holding your correspondence;
• session replay or error-reporting service that could capture what is on your screen;
• artificial intelligence or machine learning provider that processes Customer Data. No Customer Data is sent to any model, ours or anyone else's, for any purpose including training, evaluation or support. The note in section 3 says what the AI tooling we do use can see, and it is Account Data, never a record or a photograph.

Each of those is a normal thing for a SaaS product to have, and the reason to list their absence is that "the app loads no third-party script" is checkable (its Content-Security-Policy header says script-src 'self') and "we respect your privacy" is not.

Notice of changes, and objecting

Before a new subprocessor begins processing Customer Data we will give at least 30 days' notice, by updating this page and emailing your organization's owners. Google Analytics processes no Customer Data, so listing it is not a change to the processing of Customer Data; it is here because this page is meant to be the complete list, not the shortest one.

If you object on reasonable data protection grounds, tell us within those 30 days at privacy@badgewright.com. We will work with you to find another way. If there is not one, you may terminate the affected part of the Service and we will refund the unused fees. You do not have to accept a subprocessor you are not comfortable with in order to keep using something you have paid for.

Replacing one provider with another of the same kind still counts as a change and still gets the notice.