Sub-processors

How to read this page

A sub-processor is a company we engage to process data on our behalf in order to run RankX AI. Every one of them is bound by a written contract that imposes data protection obligations no less protective than those we owe you, and we remain fully liable to you for what they do.

This page is Annex C to the Data Processing Agreement. It is published rather than reproduced inside that agreement so the list and the contract cannot fall out of step with each other.

The two tables are different in kind, and the difference decides whether you have a right to object:

• Section 3 is customer data. These providers may process personal data inside your workspaces. We are your processor for it, you are the controller, and the notice and objection rights in section 5 apply.
• Section 4 is our own data. These providers process data where we are the controller: our marketing list, our own website, our corporate operations. Your workspace data does not reach them, so there is nothing there for you to object to. They are listed for completeness.

Locations are stated as the country the provider is established in and the region where processing takes place. For the definitive corporate entity and the full detail of any provider’s own processing, read that provider’s data processing agreement, which each of them publishes.

Where the platform itself runs

Before the list, the shape of it. The platform is hosted in the European Union and the compute sits next to the data on purpose:

• Application servers in Belgium. Google Cloud Run, region europe-west1.
• Primary databases in Ireland. Managed PostgreSQL on Supabase, region eu-west-1.
• Object storage in a European Union jurisdiction bucket. Cloudflare R2, with the EU jurisdiction restriction applied at the bucket, so objects cannot be stored outside it.
• Product analytics in the European Union. PostHog EU cloud, not its US cloud.

The providers that sit outside the UK and EEA are the AI model providers, the search data provider and one or two supporting services. Each is named below with the safeguard we rely on, and the transfer terms are section 13 and Annex D of the Data Processing Agreement.

Sub-processors of customer data

These providers may process personal data contained in your workspaces. This table is Annex C to the Data Processing Agreement.

Processors of our own data

These process data where RankX AI is the controller. Customer workspace data does not reach them, so the objection right in section 5 does not apply to them.

Notice of changes, and your right to object

We give at least 30 days’ notice before a new sub-processor in section 3 starts processing customer personal data. Notice is given by updating this page and its change log, and by email to customers who have asked for sub-processor notifications.

To be told by email, write to [email protected] with the subject line “sub-processor notifications” and the account you want them for.

Within those 30 days you may object on reasonable data protection grounds. We will work with you in good faith to find an alternative, such as making the affected feature avoidable. If no reasonable solution is available within a further 30 days, you may terminate the affected part of the service, or the whole subscription where the sub-processor is essential to it, with a pro rata refund of fees paid for the unused remainder of your term. The full mechanism is section 7 of the Data Processing Agreement.

We may replace a sub-processor immediately and without the notice period where the change is urgent and necessary to keep the service running or secure. We will tell you as soon as we can afterwards, and the objection right still applies from the moment you are told.

How we choose and monitor a sub-processor

Before a provider processes anything for us, we check that it:

• offers a data processing agreement meeting Article 28, with transfer clauses where the transfer is restricted;
• can describe its security measures concretely, rather than by adjective;
• processes in a region compatible with keeping the platform in the European Union, or has a good reason not to;
• in the case of a model provider, offers terms that exclude using our traffic to train its models;
• is replaceable. A provider we could not migrate away from in a reasonable time is a risk to you as well as to us, which is why model access is routed rather than wired to one vendor.

We give each provider the minimum data its function needs. That is why Google Analytics data reaches us aggregated, why the free-tool cache holds a hash rather than an address, and why no Google user data goes to a model provider.

What we do not claim. Several providers on this page hold ISO 27001 certification or a SOC 2 report. Those are their assurances, not ours. RankX AI holds neither at this time, and Annex B of the Data Processing Agreement says so in the same words.

Change log

Every addition, removal and material change to section 3 is recorded here, so a customer can see the history rather than only the current state.

Questions about anything on this page go to [email protected].