Subprocessors

1. Current subprocessors

Amazon Web Services, Inc.

Purpose

Hosting and infrastructure: application infrastructure, the PostgreSQL database and its backups, encrypted storage of customer access keys (AWS Secrets Manager and AWS KMS), logging, and network and security infrastructure.

Personal data

All data the Service holds: account and authentication data, Customer Data, findings, audit records and logs.

Where data is stored

United States, using Amazon Web Services infrastructure.

Transfer mechanism

Where the GDPR or UK GDPR requires a transfer mechanism, the Standard Contractual Clauses (and UK Addendum) in the AWS Data Processing Addendum; Amazon Web Services also participates in the EU-U.S. Data Privacy Framework.

Privacy notice

https://aws.amazon.com/privacy/

Resend

Purpose

Transactional and service email: email verification, sign-in and recovery messages, password resets, workspace invitations, and forwarding privacy requests and accessibility reports submitted through the Service to the operator’s mailbox.

Personal data

Recipient email addresses and message content, which can include a person’s name, workspace name, and the text of a privacy request or accessibility report. Security findings and other Customer Data from cloud accounts are not sent by email.

Where data is stored

United States. Resend stores account data, message content, delivery logs and related records in the United States, whichever region a message is sent from.

Transfer mechanism

Standard Contractual Clauses and UK Addendum in Resend’s data processing agreement; Resend also participates in the EU-U.S. Data Privacy Framework and its UK extension.

Privacy notice

https://resend.com/legal/privacy-policy

2. Other recipients that are not subprocessors

Google (website analytics)

If a visitor to the public website agrees to analytics cookies, Google Analytics, provided by Google LLC, measures visits to its homepage, pricing page and contact page, and processes that visitor data for the operator under Google’s data processing terms. It is never loaded in the Service and is sent no Customer Data, so it is not a subprocessor of Customer Data. What it receives is described in the Privacy Policy. Privacy notice: https://policies.google.com/privacy.

• Your own cloud accounts. When you connect an AWS account, Kultarr. reads it on your instruction; Amazon Web Services does not act for Kultarr. in that relationship.
• Repositories you connect. Kultarr. reads and proposes changes to them through the repository host’s API, using the access you grant.
• Notification channels. Kultarr. does not deliver notifications to Slack, Microsoft Teams or by email; they are shown in the Service only.
• Artificial-intelligence providers. Kultarr. sends no Customer Data to any AI model provider.
• Geolocation services. Approximate location is looked up in a database stored with the Service; IP addresses are not sent to a third party.
• Advertising and error-tracking services. Kultarr. uses none.

3. Changes to this list

Kultarr. will provide at least 30 days’ advance notice before a new subprocessor begins processing Customer Data. When that notice is given, this page is updated and its version and date change. Customers with a Data Processing Addendum may object as that agreement describes.

Questions about subprocessors, and requests to be told about changes directly, can be sent to ofirbe@kultarr.io.