SafetyPermit Sub-processor List

Status: Maintained inventory. This list is referenced by, and forms part of, the Data Processing Agreement (DPA v1.0-draft, Annex III).

This document lists the third-party sub-processors that SafetyPermit engages to process personal data on behalf of tenant Controllers. SafetyPermit imposes data-protection obligations on each sub-processor no less protective than those in the DPA, and remains responsible for their performance.

Last reviewed: [DATE TO CONFIRM] · Maintained by: [OPS / DPO CONTACT]


Current Sub-processors

Sub-processor Purpose Region Transfer mechanism
Microsoft Azure (SQL, Blob Storage, App Service) Database, file/blob storage, and application hosting [REGION TO CONFIRM] — currently DNS-implied only; pin the actual region Intra-group / Standard Contractual Clauses (SCCs)
Amazon Web Services (SES) Transactional email delivery ap-southeast-2 (Sydney, AU) AWS DPA + SCCs
SMS Gateway SMS authentication codes and notifications [PROVIDER / REGION TO CONFIRM WITH OPS] TBC
Apple APNs iOS push notifications Apple-managed Apple DPA
PDF generation service Permit PDF rendering westus2 (US) SCCs / IDTA
Anthropic (Claude) Check-in translation (es, fil) US (api.anthropic.com) SCCs / IDTA

Notes & Open Items


Change Control

Additions, replacements, or removals of sub-processors are notified to Controllers in accordance with DPA Section 7.3 (general authorisation with right to object on reasonable data-protection grounds). Update the "Last reviewed" date and notify [OPS / DPO CONTACT] whenever this table changes.


Sub-processor list — engineering-prepared draft, pending legal review.