Security

This page covers various elements of compliance and security for System Initiative

Third Party Data Processors

System Initative and its affiliates engage the third-party entities in the table below to perform limited activities in connection with the System Iniative Services. The table shows what activity each entity performs and indicates if an entity operates on the data in additional locations. More information about each activity is provided directly below. This explains the limited processing of Customer Data the entity is authorized to perform.

Last updated 25th September 2025

Data Subprocessors Table

In connection with the Data Protection Agreement, Customer is the person that determines the purposes and means for which Customer Data (as defined below) is processed (a “Data Controller”), whereas Company processes Customer Data in accordance with the Data Controller’s instructions and on behalf of the Data Controller (as a “Data Processor”). “Data Controller” and “Data Processor” also mean the equivalent concepts under Data Protection Laws.

#NameDetailsDescription
1AWSCorporate Location:410 Terry Avenue North, Seattle, WA 98109-5210, U.S.A.
Additional processing locations (if applicable):
  • US East (N. Virginia) [us-east-1]
  • Europe (Ireland) [eu-west-1]
Relevant recipient service:Cloud Platform Provider
Types of data processed by Sub-processor:
  • Full Name: first name, last name middle names and a ‘nickname’ (what the Data Controller would prefer to be called)
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (github/Discord handles)
  • Icon/Avatar: An optional avatar on the Data Controller’s profile
  • Email Address
  • IP address(es): IP addresses of the Data Controller accessing the platform
  • Other device traffic provided markers, such as MAC Addresses, hostnames, GAID/IDFA, Referrer URL or other traffic origin information
  • Geo-location(s): Physical locations where the Data Controller’s traffic came from, included but not limited to Longitude, Latitude, Postcode, Elevation and Country
Purpose description of processing: Processing any information within:
  • The SI Auth Portal
  • Any logging/network traces at the backbone level to the infrastructure.
EU/UK/Swiss data transfer mechanism in place:Find more information this here
2Auth0Corporate Location: San Francisco, 100 1st St Suite 150, San Francisco, United States.
Additional processing locations (if applicable):All US based.
Relevant recipient service:Identity and Access Management Provider.
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names and a ‘nickname’.
  • Password/Authentication Tokens.
  • Email Address.
  • IP address(es): IP addresses of the Data Controller accessing the platform.
  • Other device traffic provided markers, such as MAC Addresses, hostnames, GAID/IDFA, Referrer URL or other traffic origin information.
  • Geo-location(s): Physical locations where the Data Controller’s traffic came from.
Purpose description of processing: Processing any information within:
  • The SI Auth Portal
  • Any logging/network traces at the backbone level to the infrastructure.
EU/UK/Swiss data transfer mechanism in place:Find more information this here
3LagoCorporate Location:Paris, France
Additional processing locations (if applicable):EU-based locations
Relevant recipient service:Billing & Payment Provider
Types of data processed by Sub-processor:
  • Billing Details: Financial details and billing address(es) to issue invoices and allow the Data Controller to pay for their use on the platform
  • Transaction History: Details of payments made, including amounts and dates
  • Email Address: To send billing notifications and receipts
  • Full Name: first name, last name, middle names and a ‘nickname’
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (github/Discord handles)
Purpose description of processing: Processing payment transactions, issuing invoices related to the platform
EU/UK/Swiss data transfer mechanism in place:Unable to determine, pending query with Lago
4StripeCorporate Location: San Francisco, 354 Oyster Point Blvd, South San Francisco, CA, United States
Additional processing locations (if applicable):Global, including US, EU, and Asia-Pacific regions
Relevant recipient service:Payment Processing & Billing Provider
Types of data processed by Sub-processor:
  • Billing Details: Financial details and billing address(es) to issue invoices and allow the Data Controller to pay for their use on the platform
  • Transaction History: Details of payments made, including amounts, dates, and payment methods
  • Email Address: To send payment confirmations, billing notifications, and receipts
  • IP address(es): To track transactions and perform fraud prevention measures
  • Full Name: First name, last name, and middle names (if applicable)
  • Credit Card/Bank Details: Payment information to facilitate transactions
Purpose description of processing: Processing payment transactions, issuing invoices, and fraud detection related to payment activities on the platform
EU/UK/Swiss data transfer mechanism in place:Find more information this here
5PosthogCorporate Location:2261 Market Street #4008, San Francisco, CA 94114
Additional processing locations (if applicable):All US based
Relevant recipient service: Product analytics, feature flags, session replays, A/B Testing
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names and a ‘nickname’
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (github/Discord handles).
  • Email Address
  • IP address(es): IP addresses of the Data Controller accessing the platform
  • Other device traffic provided markers, such as MAC Addresses, hostnames, GAID/IDFA, Referrer URL or other traffic origin information
  • Geo-location(s): Physical locations where the Data Controller’s traffic came from
Purpose description of processing: Tracking user sessions & understanding individual and group user behavioral patterns
EU/UK/Swiss data transfer mechanism in place:Find more information this here
6HubspotCorporate Location:Cambridge, MA HQ. United States. 2 Canal Park
Additional processing locations (if applicable): Amazon Web Services (AWS) in the United States East region or AWS in the Germany region
Relevant recipient service:Marketing Platform
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names and a ‘nickname’
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (github/Discord handles)
  • Icon/Avatar: An optional avatar on the Data Controller’s profile
  • Email Address
  • IP address(es): IP addresses of the Data Controller accessing the platform
  • Geo-location(s): Physical locations where the Data Controller’s traffic came from
Purpose description of processing: Tracking, engaging & identifying high-value users. Storing contact information and usage logs
EU/UK/Swiss data transfer mechanism in place:Find more information on this here
7SalesforceCorporate Location:San Francisco, 415 Mission St 3rd Floor, United States
Additional processing locations (if applicable):Hyperforce, Oregon, USA
Relevant recipient service:Customer Relationship Management Platform
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names and a ‘nickname’ (what the controller would prefer to be called)
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (github/Discord handles)
  • Icon/Avatar: An optional avatar on the controller’s profile
  • Email Address
  • IP address(es): IP addresses of the controller accessing the platform
  • Other device traffic provided markers, such as MAC Addresses, hostnames, GAID/IDFA, Referrer URL or other traffic origin information
  • Geo-location(s): Physical locations where the controller’s traffic came from
Purpose description of processing:Managing Customer Relationship & their lifecycle
EU/UK/Swiss data transfer mechanism in place:Find more information on this here
8SlackCorporate Location: Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin, Ireland
Additional processing locations (if applicable):US
Relevant recipient service:Internal Communications Platform
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names, and a ‘nickname’ (what the controller would prefer to be called)
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (e.g., GitHub/Discord handles)
  • Email Address
Purpose description of processing: To effectively collaborate and support customers of the platform.
EU/UK/Swiss data transfer mechanism in place:Find more information on this here
9DiscordCorporate Location:444 De Haro Street, San Francisco
Additional processing locations (if applicable):Unable to determine from their documentation
Relevant recipient service:Internal and External Communications Platform
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names, and a ‘nickname’ (what the controller would prefer to be called)
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (GitHub/Discord handles)
  • Email Address
Purpose description of processing: To effectively collaborate and support customers of the platform
EU/UK/Swiss data transfer mechanism in place:Find more information on this here
10GoogleCorporate Location:1600 Amphitheatre Parkway, Mountain View, California
Additional processing locations (if applicable):US and EU data centres.
Relevant recipient service: Internal and External Communications Platform, IAM and Identity Provider
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names, and a ‘nickname’ (what the controller would prefer to be called)
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (GitHub/Discord handles)
  • Email Address
Purpose description of processing: To effectively collaborate, communicate and support customers of the platform
EU/UK/Swiss data transfer mechanism in place:Find more information on this here
11GitHubCorporate Location:San Francisco, 88 Colin P. Kelly Jr. Street, United States
Additional processing locations (if applicable): Unable to determine from their documentation but likely Virginia and Seattle, with caching endpoints globally distributed.
Relevant recipient service: Cloud-based platform for storing, sharing, and collaborating on code.
Types of data processed by Sub-processor:
  • Full Name: first name, last name, middle names, and a ‘nickname’ (what the controller would prefer to be called).
  • Username/Handle: Online identifiers, including usernames, handles, or aliases (GitHub/Discord handles).
  • Email Address.
  • Geo-location(s): Physical locations where the controller’s traffic came from [from the user profile].
Purpose description of processing: To collaborate with customers and community users on code changes to the products and services.
EU/UK/Swiss data transfer mechanism in place:Find more information on this here

The Future of DevOps Automation

Sign Up