Sub-processors
Every third party that touches data on our behalf, what it does, and where. It is a short list on purpose — the fewer organisations involved, the smaller the surface you have to assess.
1. What this page is
When you use InfoSec247, we process data on your behalf. To do that we rely on a small number of specialist providers — our sub-processors. This page lists all of them, and forms part of the commitment in section 11 of our terms of service.
We publish it because it is exactly the list a security questionnaire asks for, and you should not have to email us to get it.
The short version
Your incident records, evidence files and account details are hosted by Amazon Web Services in Ireland. Stripe handles payments and never receives your incident data. Google is involved only if a user chooses to sign in with a Google account. That is the entire list.
2. Current sub-processors
All sub-processors as at 22 September 2026. | |||
Provider | What it does for us | Data involved | Location |
|---|---|---|---|
Amazon Web Services | Hosting, databases, file storage, outbound email, AI processing | All customer content and account data | Europe (Ireland) |
Stripe | Subscription payments and billing portal | Billing contact, payment details, subscription records | EU and United States |
Optional “Sign in with Google”, and web font delivery | Name, email address, account identifier | EU and United States |
3. Amazon Web Services
AWS is our infrastructure provider and does the overwhelming majority of the processing. Everything runs in the Europe (Ireland) region.
Entity
Amazon Web Services EMEA SARL Max Impact Services Limited T/A InfoSec247
Purpose
Hosting and operating the entire service
Region
eu-west-1, Europe (Ireland)
Transfers
Data is stored in the EEA. AWS offers Standard Contractual Clauses and the UK Addendum in its Data Processing Addendum for any support access from outside.
More
Which AWS services, and why
AWS services in use, all within the Ireland region. | |
Service | Used for |
|---|---|
RDS (MySQL) | The databases holding account records and, in a separate database per organisation, your incident data. Not reachable from the public internet. |
S3 | Uploaded evidence files, company logos and generated assets. Encrypted at rest and versioned. |
Lambda & API Gateway | Running the application and the external API. |
CloudFront | Serving the web application over HTTPS. |
SES | Sending service email: password resets, invitations and notifications. |
Bedrock | The language model behind the AI assistant, root cause analysis and evidence summarisation. Inputs and outputs are not used to train models. |
Transcribe | Transcribing uploaded audio evidence. Only when Evidence AI is enabled. |
Textract | Extracting text from scanned PDF evidence. Only when Evidence AI is enabled. |
CloudWatch | Operational logs and metrics, used to keep the service running and diagnose faults. |
The last three — Bedrock, Transcribe and Textract — only receive incident content when your administrator has enabled an AI add-on and a user asks for it. With the add-ons switched off, no incident content reaches them.
4. Stripe
Stripe processes subscription payments. Card details are collected by Stripe directly in its own hosted checkout and never pass through our servers. We hold only the customer and subscription identifiers Stripe issues, plus the plan and status.
Entity
Stripe Payments Europe, Limited Max Impact Services Limited T/A InfoSec247
Purpose
Payment processing, invoicing, the self-service billing portal
Data involved
Billing name and email, payment instrument details held by Stripe, transaction and subscription history
Incident data
None. Stripe has no access to customer content.
Transfers
Stripe may process data in the United States under Standard Contractual Clauses and the UK Addendum
More
Stripe is also a controller in its own right for the payment data it holds, for fraud prevention and regulatory reasons.
5. Google
Google is involved in two limited ways.
Sign in with Google — optional
If a user chooses to sign in with Google rather than an email and password, Google authenticates them and tells us their name, email address and account identifier so we can match them to an account. Users who sign in with a password never touch this.
Google Fonts
Our website loads a typeface from Google Fonts, which means your browser requests the font file from Google and Google sees the request, including your IP address. No application data is involved. [Consider self-hosting the font to remove this entirely.]
Google Analytics — optional, only with consent
If you accept optional analytics cookies on our website, Google Analytics measures how the site is used (pages viewed, rough location, device type). It is never loaded unless you accept, and your IP address is anonymised. No application or incident data is involved. You can decline or choose essential only, in which case it does not run.
Entity
Google Ireland Limited Max Impact Services Limited T/A InfoSec247
Purpose
Optional single sign-on; web font delivery; optional website analytics (with consent)
Incident data
None.
Transfers
Standard Contractual Clauses and the UK Addendum
More
6. What we don’t use
Worth stating plainly, because it shortens your assessment:
No product analytics inside the application. No analytics, heatmaps or session recording on your incident data or within the app itself.
No advertising or tracking networks. Optional Google Analytics on the marketing website only, and only if you consent; nothing else.
No CRM or marketing automation platform holding your contact details.
No offshore support desk. Support is handled by us.
No third-party AI provider outside AWS. We do not send your content to OpenAI, Anthropic directly, or any other AI API.
If any of that changes, this page changes first, on the notice terms below.
7. Notice of changes
We will update this page before a new sub-processor begins processing customer data, not afterwards.
For a new sub-processor that will handle customer content, we will notify account administrators by email at least 7 days in advance.
You may object on reasonable data protection grounds within that period by writing to info@infosec247.co.uk. We will work with you to find a way forward. If we cannot, you may terminate the affected part of the service without penalty and receive a pro-rata refund of fees paid in advance.
We remain responsible to you for our sub-processors’ acts and omissions, and impose data protection terms on them at least as protective as those we owe you.
To be told about changes, email info@infosec247.co.uk and ask to be added to the notification list.
8. Questions
If you are completing a vendor assessment and need more than this page provides — a signed data processing agreement, a completed security questionnaire, or detail on a specific control — write to info@infosec247.co.uk and tell us what you need. We would rather answer properly than send a brochure.
Related: Privacy notice · Terms of service · Contact us