Sub-processors
Last updated: 2026-08-24
The following third parties process Customer Personal Data on Zotniq's behalf as sub-processors, under the terms of the Zotniq Data Processing Agreement. Zotniq imposes on each sub-processor data-protection obligations that are no less protective than those in the DPA, and remains liable for their performance.
| Sub-processor | Purpose | Region | Their DPA |
|---|---|---|---|
| Amazon Web Services (AWS) | Compute and storage for the Zotniq cloud (findings ingestion, dashboard, audit log) | US-east-1 (US customers) · EU-west-1 (EU customers) | View |
| Cloudflare | DNS, edge network, WAF, TLS termination for public-facing endpoints | Global (traffic served from the nearest edge) | View |
| Kinde | Identity provider (SSO, session management for the Zotniq dashboard) | US | View |
| PostgreSQL on Amazon RDS | Application database (org state, rules, audit log metadata) | Per-org: US-east-1 or EU-west-1 | View |
Change notifications
Zotniq provides at least 30 days notice before engaging any new sub-processor, or before an existing sub-processor materially changes the region or purpose for which it processes Customer Personal Data.
To receive change notifications, email [email protected] with your organisation name and the address that should receive the notifications. Customers may object to a new sub-processor on reasonable grounds within the notice period, per section 4 of the DPA.
Contact
Data-protection questions: [email protected]
Security questions: [email protected]