Subprocessors

Asiyst uses selected third-party service providers to operate, secure, maintain, and improve the Services.

These providers may process certain information on Asiyst's behalf and may therefore act as subprocessors where applicable under data protection laws or contractual arrangements.

This Policy applies to third-party service providers that process Customer Data or other information on behalf of Asiyst in connection with the Services.

It does not necessarily apply to independent third-party services that customers choose to connect to the Services where those providers act independently.

A “Subprocessor” means a third-party service provider engaged by Asiyst to process Personal Data on behalf of Asiyst's customers where such provider qualifies as a subprocessor under applicable data protection requirements.

A provider does not become a Subprocessor solely because it provides a general business service to Asiyst.

Asiyst may use subprocessors for functions including:

• Cloud infrastructure.
• Database hosting.
• Data storage.
• Authentication.
• AI model processing.
• Analytics.
• Monitoring.
• Security.
• Email delivery.
• Customer support.
• Payment processing.
• Error tracking.
• Communications.
• File processing.
• Content delivery.
• Infrastructure management.

The actual providers used may change over time.

Asiyst may maintain a current list of subprocessors through its designated Subprocessors page, documentation, trust center, or other appropriate location.

The list may identify:

• Subprocessor name.
• Service provided.
• Processing purpose.
• Relevant processing location or region where appropriate.
• Applicable data categories where appropriate.

Asiyst may add, replace, or remove subprocessors as necessary to operate and develop the Services.

Changes may occur because of:

• Service improvements.
• Infrastructure changes.
• Security requirements.
• Availability requirements.
• Business requirements.
• Provider changes.
• Geographic requirements.
• Regulatory requirements.

Where required by applicable law or contractual agreement, Asiyst may provide notice before appointing a new subprocessor.

Notice may be provided through:

• The Subprocessors page.
• Email.
• Customer dashboard.
• Other contractual notification mechanisms.

Where a customer's applicable Data Processing Agreement or other written agreement provides a right to object to a new subprocessor, the customer may exercise that right according to the procedure and timeframe specified in the applicable agreement.

A general listing of a provider does not independently create an objection right where no such right applies.

Where applicable, an objection should identify:

• The relevant subprocessor.
• The reason for the objection.
• The specific data protection concern.
• Relevant supporting information.

Asiyst may review objections and determine whether an appropriate solution is available.

Where required by the applicable agreement, Asiyst may use commercially reasonable efforts to address a valid objection.

Possible measures may include:

• Reviewing the relevant processing activity.
• Implementing additional safeguards.
• Offering an alternative configuration where available.
• Replacing the relevant provider where reasonably practicable.
• Providing other measures required by the applicable agreement.

Asiyst may enter into written agreements with subprocessors that impose appropriate obligations relating to:

• Confidentiality.
• Security.
• Data protection.
• Processing limitations.
• Incident handling.
• Data deletion.
• Other applicable requirements.

Subprocessors may process Personal Data only for purposes consistent with their engagement by Asiyst and the applicable contractual requirements.

Subprocessors are not authorized to use Customer Data for unrelated purposes merely because they receive access to it.

Asiyst expects subprocessors that have access to Customer Data to maintain appropriate confidentiality obligations.

Access should be limited to personnel and systems that require access for authorized purposes.

Asiyst may require subprocessors to maintain appropriate technical and organizational security measures appropriate to the services they provide.

Depending on the service, measures may include:

• Access controls.
• Encryption.
• Authentication controls.
• Logging.
• Monitoring.
• Vulnerability management.
• Incident response.
• Backup protections.
• Personnel controls.

Asiyst may evaluate subprocessors using appropriate risk-management processes.

Evaluation may consider:

• Security practices.
• Data protection practices.
• Service criticality.
• Processing activities.
• Certifications or attestations where available.
• Contractual protections.
• Security incidents.
• Geographic considerations.

Subprocessors may receive only the access reasonably required to provide their contracted services.

Where technically and operationally appropriate, Asiyst may use access restrictions, service accounts, role-based permissions, or other controls.

Asiyst may seek to limit the information provided to a subprocessor to information reasonably necessary for the applicable service.

The amount and type of information processed depends on the functionality used.

Asiyst may use third-party AI model providers to process AI requests.

Where an AI provider acts as a subprocessor for applicable Customer Data, its processing is subject to the applicable contractual and data-protection arrangements.

AI provider processing may include:

• AI prompts.
• AI responses.
• Context supplied with a request.
• Knowledge-source content.
• Files or other inputs required to perform the requested operation.

Customers may be able to connect their own AI provider accounts or API credentials.

In such cases, the relevant AI provider may process information directly under the customer's relationship with that provider.

The customer's selected provider may have its own:

• Privacy policy.
• Terms.
• Data retention practices.
• Security practices.
• Data-processing terms.

Not every third-party service connected to Asiyst is a Subprocessor.

A third-party service may act independently where:

• The customer directly contracts with the provider.
• The customer controls the integration.
• The provider determines its own processing purposes.
• The provider operates independently from Asiyst.

When a customer connects an external service to Asiyst, Asiyst may process information required to establish and operate that connection.

The external provider may separately process information according to its own terms.

Payment processors may process payment and transaction information necessary to complete payments.

Payment providers generally operate under their own contractual and privacy frameworks.

Payment-processing arrangements may be described separately in Asiyst's Payment Terms and Privacy Policy.

Asiyst may use third-party email delivery providers to send transactional, security, support, or other permitted communications.

Such providers may process information including:

• Email addresses.
• Message content.
• Delivery information.
• Bounce information.
• Engagement information where applicable.

Where analytics services are used, those providers may receive technical or usage information necessary to provide analytics functionality.

The specific information shared depends on the analytics configuration.

Asiyst may use third-party monitoring, logging, error-tracking, security, and infrastructure services.

These providers may process technical information such as:

• IP addresses.
• Device information.
• Request information.
• Error information.
• Application logs.
• Security events.

Asiyst may rely on cloud infrastructure providers for:

• Computing.
• Databases.
• Storage.
• Networking.
• Backups.
• Content delivery.
• Other infrastructure functions.

Customer Data stored or processed within such infrastructure may therefore be subject to the provider's underlying infrastructure systems.

Subprocessors may process information in countries or regions where Asiyst or its service providers operate.

Processing locations may vary by:

• Provider.
• Service.
• Customer configuration.
• Infrastructure region.
• Legal requirements.

Where Personal Data is transferred internationally, Asiyst may implement appropriate transfer mechanisms where required by applicable law.

Depending on the circumstances, mechanisms may include:

• Contractual safeguards.
• Standard contractual clauses where applicable.
• Adequacy decisions.
• Other legally recognized transfer mechanisms.

Where required, Asiyst may require subprocessors to provide protections appropriate to the nature of the Personal Data being processed.

These obligations may address:

• Processing instructions.
• Confidentiality.
• Security.
• Data-subject rights.
• Incident response.
• Deletion or return of data.
• Assistance with compliance requirements.

If Asiyst becomes aware of a security incident involving a subprocessor that materially affects Customer Data, Asiyst may take appropriate response measures.

Depending on the circumstances, these may include:

• Investigating the incident.
• Coordinating with the provider.
• Implementing containment measures.
• Assessing affected information.
• Notifying affected customers where required.
• Taking corrective measures.

Asiyst may require relevant subprocessors to cooperate with incident investigations and provide information reasonably necessary to understand and address an incident.

When processing is no longer required, Asiyst may require subprocessors to delete or return applicable Customer Data where required by contract or applicable law.

Deletion may be subject to:

• Legal retention obligations.
• Backup cycles.
• Security requirements.
• Technical limitations.
• Applicable contractual requirements.

Data may remain temporarily within encrypted or otherwise protected backups after deletion from active systems.

Backup deletion may occur according to the applicable backup lifecycle.

Subprocessors may permit authorized personnel to access information where necessary to provide their contracted services.

Such access should be subject to appropriate confidentiality and security requirements.

Information regarding certain subprocessors may be subject to confidentiality restrictions.

Where appropriate, Asiyst may provide general descriptions instead of confidential contractual or security details.

Where available and relevant, Asiyst may consider third-party certifications, attestations, security reports, or similar documentation when evaluating subprocessors.

The existence of such documentation does not mean that every Asiyst Service or processing activity is covered by a particular certification or attestation.

Listing a provider as a Subprocessor does not represent that Asiyst or the provider holds a particular security or privacy certification unless that certification is expressly identified.

Customers remain responsible for:

• Determining whether Asiyst is appropriate for their processing activities.
• Configuring Services appropriately.
• Providing lawful instructions.
• Obtaining required permissions.
• Managing customer-controlled integrations.
• Informing relevant individuals where required.
• Avoiding unnecessary sensitive information where appropriate.

Customers should not provide sensitive Personal Data to Asiyst unless:

• The processing is permitted.
• The customer has an appropriate lawful basis.
• The applicable Service supports the processing.
• Any required contractual protections are in place.

Additional restrictions may apply to particular Services.

Where a customer is entitled to assistance under an applicable DPA, Asiyst may coordinate with relevant subprocessors as reasonably necessary to support the request.

Subprocessors may be required to respond to legally valid government or law-enforcement requests.

Where legally permitted, Asiyst may seek to maintain appropriate protections for Customer Data and notify affected customers when required.

If an applicable customer agreement contains specific subprocessor requirements, those contractual requirements control to the extent they conflict with this Policy.

Unless expressly agreed otherwise, a customer's use of the Asiyst Services does not create a direct contractual relationship between the customer and Asiyst's subprocessors.

Using a Subprocessor does not transfer ownership of Customer Content or Customer Data to the Subprocessor.

Rights in Customer Data remain governed by the applicable agreements and policies.

Certain subprocessors may impose additional terms applicable to particular services or functionality.

Where applicable, customers may be required to comply with those terms.

The availability of a particular Subprocessor may affect the availability of the associated Asiyst functionality.

Third-party service interruptions may therefore affect Service functionality.

Asiyst may replace a Subprocessor where reasonably necessary for:

• Security.
• Reliability.
• Availability.
• Cost or operational requirements.
• Compliance.
• Product development.
• Business continuity.

Where applicable, replacement will be handled according to the relevant contractual requirements.

Where necessary to address an urgent security, operational, legal, or business-continuity issue, Asiyst may make an emergency provider change subject to applicable legal and contractual requirements.

Asiyst may restrict or discontinue a Subprocessor's access where Asiyst determines that the provider no longer meets applicable operational, security, legal, or contractual requirements.

Where required by an applicable DPA or agreement, Asiyst may provide reasonable information concerning relevant subprocessors to support customer compliance obligations.

This may include available:

• Security documentation.
• Certifications.
• Audit reports.
• Privacy documentation.
• Processing descriptions.

Customer audit rights relating to subprocessors are governed by the applicable DPA or written agreement.

Direct audits of a Subprocessor may not always be available where alternative compliance evidence is contractually permitted.

Asiyst seeks to maintain accurate information regarding relevant subprocessors.

However, the exact providers used may vary depending on:

• Service configuration.
• Infrastructure.
• Geographic location.
• Product changes.
• Customer configuration.

The Privacy Policy describes Asiyst's broader collection, use, disclosure, and protection of information.

This Subprocessors Policy specifically addresses third-party providers that may process information on Asiyst's behalf.

Where a Data Processing Agreement applies, its subprocessor provisions control to the extent they conflict with this Policy.

Security requirements for third-party providers are also addressed in Asiyst's Security Policy and Security & Trust Center.

Retention of information processed by subprocessors is subject to applicable retention requirements and technical processing arrangements.

Subprocessor retention periods may vary according to the service and applicable agreement.

Deletion requests are handled according to Asiyst's Data Deletion Policy, applicable agreements, and technical requirements.

Where appropriate, Asiyst may instruct relevant subprocessors to delete applicable information.

Asiyst may update this Subprocessors Policy when its provider relationships, Services, processing activities, or legal obligations change.

Material changes may be communicated through appropriate channels where required.

Questions regarding Asiyst subprocessors, subprocessor changes, data processing, or related compliance matters should be submitted through the applicable Asiyst support, privacy, or legal contact method.