Sub-processors
Every third party that touches data on our behalf, what they do, and where they are. If you are running a security review, this is the page you want.
Email dpo@sabikisecurity.com and ask to be added to the sub-processor notification list. We will tell you before a new sub-processor starts processing your data, not after.
1. Who touches data from your Microsoft 365 tenant
This is the list that matters for your Data Processing Addendum. These are the only parties that see anything from inside your tenant. Everything in section 2 below is about our own website and billing, and never touches a client tenant at all.
| Sub-processor | What it does | Data it touches |
|---|---|---|
| Microsoft Your tenant's own region | AIRM reads from your Microsoft 365 tenant through the Graph API | The tenant is yours. Microsoft is your provider, not ours. We list it because a complete picture matters more than a tidy one. |
| Microsoft Azure Southeast Asia region (Singapore) | Hosts the AIRM application and the customer portal | Identity metadata and risk findings. Not your emails, files or content, which AIRM does not read. Azure holds ISO/IEC 27001, ISO 27018 and SOC 1, SOC 2 Type 2 and SOC 3, published in the Microsoft Trust Center. |
| MongoDB Atlas Managed database, on Azure, Southeast Asia region (Singapore) | Stores the identity inventory and the risk findings AIRM produces | The same identity metadata and risk findings. MongoDB Atlas holds ISO/IEC 27001:2022, ISO 27017, ISO 27018, SOC 2 and CSA STAR, published in the MongoDB Trust Center. |
2. Who touches our website and billing data only
None of these ever sees a client tenant. They are listed because a complete picture is worth more than a tidy one, but they are not sub-processors under your DPA, because they process nothing that comes from your Microsoft 365 environment.
| Company | What it does | Data it touches |
|---|---|---|
| Netlify United States, global CDN | Hosts and serves sabikisecurity.com, and receives blog subscriptions | Server logs (IP address, browser type, page requested, timestamp). Plus your email address, if you subscribe to the blog. Nothing from the ROI calculator, which never sends anything anywhere. |
| Paddle United Kingdom / Ireland, merchant of record | Processes subscription payments. Paddle is the seller of record for the transaction, and handles invoicing and sales tax | Your billing name, billing address, email address and payment details. Card details go to Paddle, never to us. Paddle is a controller in its own right for this data, not merely our processor, and it applies its own terms and privacy policy. |
| Google (Fonts) United States | Serves the typefaces on our website | Your IP address, at the moment the fonts load. Nothing else. |
| Cal.com See their privacy policy | Handles demonstration bookings | Your name, email address, and anything you type into the booking form |
3. Not sub-processors at all
Two entries you might expect, and why they are not here.
- No analytics provider. We do not use Google Analytics, Plausible, Hotjar, Segment or anything comparable. There is no analytics sub-processor because there is no analytics.
- No AI provider. We previously carried a chat widget that would have sent visitor messages to a third-party model provider. It was never functional and it was removed on 13 July 2026. No visitor message was ever transmitted. If we reintroduce a chat, this page will name the provider before it goes live.
4. Objecting to a sub-processor
If you have a reasonable, documented objection to a new sub-processor on data protection grounds, tell us. We will work with you to find an alternative. If we cannot, you may terminate the affected part of your subscription without penalty. That right is set out in the Data Processing Addendum.
← All legal documents