Snapshot 21491
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security Standards / Subprocessor Policy Security Standards · Trust Center Subprocessor Register Every third party Ascendo AI engages to help deliver and operate our platform: what each one does, what data it touches, and where that data is processed. 10 Active subprocessors 4 Processing categories 4 Countries of incorporation US + EU Primary data regions A subprocessor is any third party Ascendo AI engages to process customer data on our behalf in order to provide the Ascendo platform. This register lists every subprocessor currently in use, organized by what they do, what kind of data they touch, and where that processing happens. We review every subprocessor before onboarding and at least once a year after that, require a written data processing agreement from each one, and tell customers about material changes. Questions about a specific entry or this register can go to [email protected]. Search by name, purpose, or data type, or filter by category. No subprocessors match that search. Try a different term or clear the filter. Cloud Infrastructure & Hosting 3 subprocessors The compute, storage, and hosting layer our platform and AI workloads run on. Subprocessor Purpose Data processed Location Status Google Google Inc. Cloud compute and storage on Google Cloud Platform, including self-hosted PostgreSQL database infrastructure Customer and case data processed for hosting, storage, and database operations HQ: Mountain View, CA, USA Multiple US data center regions; processing limited to the US and EU Active MongoDB Atlas MongoDB, Inc. Managed cloud database (MongoDB Atlas) for operational and application data storage Customer application data, case records, configuration data HQ: New York, NY, USA Multiple US/EU regions, per deployment configuration Active Vercel Vercel Inc. Hosting and content delivery for Ascendo's web application and front-end Application traffic, session and authentication data; no case content stored HQ: San Francisco, CA, USA Global edge network; primary regions in the US Active AI & Embedding Model Providers 2 subprocessors Model APIs we call to turn case and knowledge content into embeddings and generate AI-assisted responses. Subprocessor Purpose Data processed Location Status OpenAI OpenAI, L.L.C. AI model and embedding API processing to support natural-language understanding and generation Text content submitted for AI processing and embedding generation HQ: San Francisco, CA, USA Processing region: United States Active Voyage AI Voyage AI Innovations, Inc. Embedding model API (Voyage 3 and successor models) for semantic and vector search Text content submitted for embedding generation HQ: Palo Alto, CA, USA Processing region: United States Active Data & Search Infrastructure 1 subprocessor The vector search engines that store and retrieve your data. Some run inside our own Google Cloud environment; others are managed cloud services, noted per row below. Subprocessor Purpose Data processed Location Status Qdrant† Qdrant Solutions GmbH Vector database for similarity search and retrieval Vector embeddings and associated metadata HQ: Berlin, Germany Self-hosted on Google Cloud, or Qdrant Cloud; varies by deployment Active † Qdrant runs either as a self-hosted instance inside Ascendo's own Google Cloud Platform environment, or via Qdrant Cloud, depending on the deployment. Where self-hosted, the provider itself does not receive or process customer data. Business Operations & Support Tools 4 subprocessors The systems our finance, support, and delivery teams use day to day. Subprocessor Purpose Data processed Location Status Sage Intacct Sage Intacct, Inc. (The Sage Group plc) Cloud ERP for finance and accounting operations Financial data, including customer information, vendor data, and employee details HQ: Redwood City, CA, USA Processing region: United States Active Atlassian Atlassian Corporation Customer support ticketing (Jira Service Management) and internal project & documentation management (Jira, Confluence) Customer support tickets and communications; internal project and documentation data HQ: Sydney, Australia / San Francisco, CA, USA Processing regions: United States and Australia Active Twilio Twilio Inc. Communications platform for SMS, voice, and customer outreach, plus transactional and notification email delivery via SendGrid Customer contact information (name, email, phone number), message content, and delivery metadata HQ: San Francisco, CA, USA Processing region: United States Active Zendesk Zendesk, Inc. CRM and support ticketing platform Customer service data, including support tickets, contact information, and communication history HQ: San Francisco, CA, USA Processing region: United States Active Affiliates Ascendo AI, Inc.United StatesMay access customer data solely to provide and support the service. Before onboarding Written agreements Every subprocessor that touches customer data signs a data processing agreement with confidentiality, security, and breach-notification terms that match or exceed what we commit to in our own customer agreements. On a schedule Security review We review each subprocessor's security certifications (SOC 2, ISO 27001, or equivalent) before granting access, and again at least once a year or whenever their service changes in a way that affects how data is handled. By design Least privilege Each subprocessor receives only the data and access required for its specific function. Where it's practical, we minimize or scope data before it ever reaches a subprocessor's systems. Some subprocessors rely on their own sub-processors, most often underlying cloud infrastructure, to deliver their service. Our agreements require the same data-protection obligations to flow down to those sub-processors. International data transfers Some subprocessors process data outside the region where it originated. Where that happens, we rely on Standard Contractual Clauses or another lawful transfer mechanism, consistent with our GDPR commitments. See our Data Processing Agreement and GDPR page for the contractual detail. Have questions? Our security team can answer questions about subprocessors, data handling, or any concerns you may have about this register. Contact Security Team