Last reviewed 20 September 2026
A sub-processor is a third party we use to process personal data on behalf of our customers. This page lists all of them. It is the authoritative list referred to in section 6 of our Data Processing Agreement, and it is the same list as Annex III of that agreement.
Soreg runs inside your environment. Your records, your queries, the masked payloads sent to the model, the re-identified results and your audit log never reach us — so there is nothing of that kind for a sub-processor to touch either.
What the parties below handle is the ordinary business relationship around the software: who your administrators are, what you were invoiced, and what you wrote to us when you opened a support ticket. That is a much shorter list than most vendors can offer, and it is short for an architectural reason rather than a policy one.
These parties process personal data on behalf of our customers under section 6 of the DPA.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Microsoft Corporation | Azure hosting for the website and account systems; Microsoft 365 for business email | Account and administrator contact details; support correspondence | United States |
| HubSpot, Inc. | Customer relationship management | Name, work email, company, job title, organisation size | United States |
| [PLACEHOLDER — payment processor not yet selected] | Payment processing and invoicing | Billing contact details and transaction records | — |
No sub-processor has access to Gateway Data. We have none to give them. Gateway Data means your source records, the queries your users run, the masked payloads sent to a model provider, the re-identified results, and the audit log. All of it stays in your deployment. This is a property of how the software is built, not a promise about how we behave.
These parties touch the soreg.ai website only. They do not process personal data on behalf of our customers, so they are not sub-processors under the DPA — but people ask, and a list that quietly omits them is not much use. Our Privacy Policy covers what each one does in more detail.
| Party | Purpose | Data processed | Location |
|---|---|---|---|
| Cloudflare, Inc. | Cookieless website analytics | Page views and referrers; receives the request IP address in the course of producing counts | United States |
| Calendly LLC | Booking calls with us | Loads only if you open the scheduler; then receives IP address, browser information, and whatever you enter to book | United States |
Soreg sends masked payloads to a large language model provider that you configure and you contract with — your own Anthropic, OpenAI, Azure OpenAI or self-hosted endpoint, using your own key. We are not a party to that relationship, we do not appoint the provider, and we never see the traffic.
So the provider is not our sub-processor. It is a processor you have engaged directly, and your agreement with them governs it. Section 10 of our Terms of Service says the same thing in contractual language.
This matters for your own Article 28 records: the provider belongs on your sub-processor list, not ours. We mention it because more than one security reviewer has expected to find it here, and the absence is deliberate rather than an oversight.
Before we add or replace a sub-processor, we will give you at least 30 days' notice, by email to your account contact and by updating this page.
If you reasonably object on data protection grounds within those 30 days, write to privacy@soreg.ai. We will work with you in good faith to find an alternative. If we cannot, you may terminate the affected part of the service and we will refund prepaid fees for the unused period. We will not treat the objection as a breach by you. That is section 6.4 of the DPA, and it is a real remedy rather than a decorative one.
Email privacy@soreg.ai with the subject line Subscribe to sub-processor notifications and we will add you to the notification list. Tell us the address you want notices to go to if it is not the one you are writing from — for a lot of organisations that is a shared compliance mailbox rather than a person.
You do not need to be an existing customer to subscribe, and we will not use the address for anything else.
The Data Processing Agreement sets out our processor obligations in full, including what we do and do not receive (section 2), international transfers and the standard contractual clauses (section 12), breach notification (section 9), and the technical and organisational measures in Annex II. The Privacy Policy covers the website. The Terms of Service and End User Licence Agreement cover the commercial and licensing terms.