CogniScale Sub-processor List
Last updated: 28 September 2026 (v1.2). First published 1 June 2026 (v1).
This list is reconciled against our current infrastructure records as of 28 September 2026. Where a provider's live production use could not be confirmed offline, we say so rather than asserting it is in production today.
We are continuing to refine these documents based on customer feedback and ongoing review.
A sub-processor is a third party that processes customer data on CogniScale's behalf. Under Article 28 of the UK GDPR and the EU GDPR, we are required to publish this list and notify customers in advance of any change.
We review this list whenever we add or change a provider. Any new sub-processor is notified to customers 30 days before they begin processing live customer data, with a documented opportunity to object.
Controller
| Field | Value |
|---|---|
| Legal entity | Network Sunday Global Limited (trading as CogniScale) |
| Company number | 07832813 |
| Registered office | Queensbury House, 106 Queens Road, Brighton, BN1 3XF |
| Incorporated in | United Kingdom |
| Contact for sub-processor queries | [email protected] |
Sub-processors in production today
AI model providers
| Sub-processor | Legal entity | What they do | Data processed | Processing location | Transfer mechanism (where applicable) |
|---|---|---|---|---|---|
| Anthropic | Anthropic PBC (US) | Processes prompts for Claude responses through CogniScale's API account. | Task content sent for inference and per-request metadata | United States | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| OpenAI | OpenAI, L.L.C. (US) | Processes prompts for GPT responses through CogniScale's API account when that route is selected. | Task content sent for inference and per-request metadata | United States | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Google Cloud | Google LLC (US) | A Gemini inference route exists via Vertex AI. Listed here because the route is configured; live customer production use had not been confirmed as of 28 September 2026 | Conversation content sent for inference (text), per-request metadata, where this route is used | US, EU (Belgium / Netherlands) | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Mistral AI | Mistral AI SAS (France) | A Mistral inference route exists via API. Listed here because the route is configured; live customer production use had not been confirmed as of 28 September 2026 | Conversation content sent for inference (text), per-request metadata, where this route is used | EU (France) | No transfer outside EU/EEA |
| Fireworks AI | Fireworks AI, Inc. (US) | An open-weight inference route exists. Listed here because the route is configured; live customer production use had not been confirmed as of 28 September 2026 | Conversation content sent for inference (text), per-request metadata, where this route is used | US | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Cerebras Systems | Cerebras Systems, Inc. (US) | An open-weight inference route exists. Listed here because the route is configured; live customer production use had not been confirmed as of 28 September 2026 | Conversation content sent for inference (text), per-request metadata, where this route is used | US | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Groq | Groq, Inc. (US) | An open-weight inference route exists. Listed here because the route is configured; live customer production use had not been confirmed as of 28 September 2026 | Conversation content sent for inference (text), per-request metadata, where this route is used | US | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
AI accounts you supply are not CogniScale sub-processors. When you connect your own AI subscription, that account is yours and is governed by your agreement with the provider. This is separate from CogniScale's API accounts listed above.
Infrastructure providers
| Sub-processor | Legal entity | What they do | Data processed | Processing location | Transfer mechanism (where applicable) |
|---|---|---|---|---|---|
| Supabase | Supabase, Inc. (US, incorporated; operates EU regions) | Provides platform authentication, the main application database and file storage. Holds records needed to maintain authorised Google connections. | Account and organisation records, connection metadata and access tokens, together with the other platform data stored for the configured service. | London, United Kingdom (AWS eu-west-2) | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Railway | Railway Corp (US, incorporated; operates EU and US regions) | Hosts client-facing services, including the AI router and gateway, colleague memory, sign-in, support and document signing. Task content passes through the AI router to the AI provider the customer chooses. | Task content sent through the router, per-request inference metadata and service data processed by the listed client-facing services | Railway's EU region in Amsterdam for every client-facing service, measured 28 September 2026 at 12:52 | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Netlify | Netlify, Inc. (US, incorporated; operates UK region) | Hosts the web application and application functions, including Google connection callbacks and credential delivery to authorised sessions. | Web request information and connection data, including credentials handled by these functions. | UK (London, eu-west-2) as of the 14 September 2026 configuration; we will confirm the current function region from the production deployment | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| GitHub | GitHub, Inc. (US, wholly owned by Microsoft Corporation) | Private GitHub repositories hold some customer workspace and colleague material. Their contents depend on the organisation's configuration. | Workspace knowledge and wiki entries | US (primary); EU available on request via GitHub Enterprise Cloud EU | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Arcade | Arcade.dev, Inc. (US) | Brokers authorisation for connected services and maintains the credentials needed for those connections. | Connected account identity, granted permissions and connection credentials. | US, EU | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Cloudflare R2 | Cloudflare, Inc. (US, incorporated; operates EU regions) | Holds encrypted database backups in an EU-jurisdiction bucket. | Encrypted database backup content | EU | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Resend | Resend, Inc. (US) | Sends transactional emails, including connector notifications, where the production send function is configured for an organisation. | Destination email address, subject line and message content of the emails sent | US | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
Operational sub-processors
| Sub-processor | Legal entity | What they do | Data processed | Processing location | Transfer mechanism (where applicable) |
|---|---|---|---|---|---|
| Google Workspace | Google LLC (US, incorporated; operates EU regions) | Email, calendar and document storage for CogniScale staff. Customer communications inbound to CogniScale arrive here. | Customer support email addresses and message content | EU (Ireland) | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
| Zoom | Zoom Video Communications, Inc. (US) | Used for meetings with CogniScale staff where customers meet our staff through Zoom. | Meeting details and content from meetings with CogniScale staff | Depends on the account settings; ask us for the current location | Provider terms and transfer safeguards depend on the account used; ask us for current details |
| Slack | Slack Technologies, LLC (US) | Used for messages with CogniScale staff where customers message our staff through Slack. | Contact details and messages exchanged with CogniScale staff | Depends on the account settings; ask us for the current location | Provider terms and transfer safeguards depend on the account used; ask us for current details |
| Stripe | Stripe Payments Europe Limited (Ireland) and Stripe, Inc. (US) | Stripe is used if an organisation pays through our Stripe billing route. Listed here because the route is configured; a live production customer billing transaction had not been confirmed as of 28 September 2026. | Customer billing contact data, payment method tokens where this route is used (no card numbers are seen by CogniScale) | EU (Ireland) for EU customers; US for US customers | EU-US Data Privacy Framework + UK Extension, with SCCs Module 2 + UK IDTA Addendum as fallback |
Where Google Workspace (Gmail, Drive, Calendar) is NOT a sub-processor
When a user of the platform connects their own Google Workspace account via OAuth, Google is not CogniScale's sub-processor for that connection. The user has authorised CogniScale Helper to read data from their own Google account using their own credentials, under the user's existing relationship with Google.
Arcade manages the connection, and CogniScale's platform services also process and store connection information and an access token. This is separate from Google's storage of the user's source messages, calendar events and files. The user's Google Workspace contract governs that processing.
A service you connect under your own account keeps its direct relationship with you in this way. Separately, our own Google Workspace and our own GitHub storage are sub-processors where they hold customer information for us, as listed in the tables above.
Notification of changes
We notify customers of material new sub-processors as the Data Processing Agreement requires. Contact [email protected] for the current process and timing for a specific change.
Document control
| Field | Value |
|---|---|
| Version | v1.2, 28 September 2026 accuracy correction |
| Date | 28 September 2026; first published 1 June 2026 (v1) |
| Change log | v1.2, 28 September 2026: updated provider locations and purposes, added meeting and messaging providers, named the file-storage provider, retained the email provider, and clarified AI and account routes. v1.1, 14 September 2026: removed Auth0; corrected the roles, data and regions for Netlify, Supabase, Arcade and Anthropic; added a visible last-updated line. v1, 1 June 2026: first published. |
| Owner | Network Sunday Global Limited (trading as CogniScale) |
| Company number | 07832813 |
| Registered office | Queensbury House, 106 Queens Road, Brighton, BN1 3XF |
| Contact | [email protected] |
| Review | Last reviewed 28 September 2026 |