Sub-processors
The third parties that process personal data on our behalf, for the CNA service and for this website.
Draft v0.1 (October 2026). This list is for review by our legal advisers, and is not yet in force. Last updated: [PLACEHOLDER: effective date].
For the monitoring service we are our customers' processor, and these providers are our sub-processors under the customer's data processing terms: [PLACEHOLDER: link or reference to the customer DPA]. For the website and enquiries we are the controller, and the providers below act as our processors. Each is bound by a written contract with data protection terms. See the service privacy notice and the website privacy notice.
Current list
| Sub-processor | Service | Data | Location | Safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting each customer's dedicated Cloud Unit: portal, databases and alerting | All service data: monitoring data, portal access and configuration data, portal user details | United Kingdom | Not needed: the data stays in the UK |
| Grafana Labs, which runs the AI assistant. Its model providers, serving Claude models: Anthropic, Google (Vertex AI) and Amazon Web Services (Amazon Bedrock). Web searches send only the search terms, to Tavily. | The AI assistant in the portal | Questions typed into the assistant, the monitoring data needed to answer them, and the answers | European Union / EEA (Grafana Labs' EU region). Tavily: [PLACEHOLDER: Tavily processing location] | UK adequacy regulations for the EEA. Tavily: [PLACEHOLDER: safeguard, if outside the UK and EEA] |
| Cloudflare, Inc. | Hosting this website | Request data: IP address, page requested, browser type and time | Worldwide network; Cloudflare, Inc. is in the USA | UK Extension to the EU–US Data Privacy Framework (UK–US data bridge) |
| [PLACEHOLDER: provider of the info@cnassess.co.uk mailbox] | Our email, which receives enquiries | Enquiry details and correspondence | [PLACEHOLDER: mailbox region] | [PLACEHOLDER: safeguard, if outside the UK] |
Alert emails are sent by a mail relay that we operate ourselves, so no third party delivers them.
The private AI option, coming next, is being built on Amazon Bedrock (AWS), in an account and region chosen for each customer. It will be listed here before it processes any customer's data.
Alert destinations that a customer chooses for itself, such as its own chat, ITSM or on-call tools, are not listed here: see "Who can see it" in the service privacy notice.
Changes to this list
We will notify customers of any new or replacement sub-processor [PLACEHOLDER: notice period] before it starts processing their data, so that they can object as their data processing terms allow. Subscribe to notifications by emailing info@cnassess.co.uk.