Sub-processors
Every third party we use to process personal data on your behalf — what they do, what data they touch, where they're located, and how the transfer is safeguarded.
This list exists to satisfy Article 13(1)(f) of the GDPR directly — not just to say safeguards exist, but to name who they're with. We keep it current and update the date below whenever it changes.
If we add a new sub-processor, we will update this list and, for clients with a Data Processing Agreement in place, give notice before the change takes effect, consistent with the objection right described in that agreement.
| Sub-processor | Purpose | Data Categories | Location | Transfer Mechanism | Status |
|---|---|---|---|---|---|
| Google Ireland Limited (Firebase / Google Cloud Platform) | Authentication, database, file storage, and hosting for the Member Portal (portal.nordicriser.com) | Account credentials, profile data, uploaded document contents, secure message content, case and payment records | Google Cloud infrastructure — specific processing region pending internal confirmation (see note below) | Google Cloud's Cloud Data Processing Addendum, incorporating the European Commission's Standard Contractual Clauses | Verification Required |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | AI-generated risk, cost, and productivity analysis in NR-BOS (optional feature) | Project and company names, budget figures, task details, cost entries, and generic per-project labels for team members (real names are pseudonymized before transmission) | China | Standard Contractual Clauses (controller-to-processor module). China has no European Commission adequacy decision — see Privacy Policy Section 6.4 for the full disclosure | Confirmed |
| PostgreSQL database (NR-BOS) | Core relational data storage — users, companies, projects, tasks, cost entries, field reports, license records | Broad — effectively all NR-BOS operational data, including personal data of client company staff | Pending internal confirmation | Pending internal confirmation | Verification Required |
| Object storage, S3-compatible (NR-BOS) | Worksite photograph storage and generated PDF client reports | Photograph files (may include camera-embedded EXIF such as GPS coordinates or a timestamp), PDF report documents | Pending internal confirmation | Pending internal confirmation | Verification Required |
Rows marked “Verification Required” are confirmed to exist and to receive the stated data category — we verified this directly against our own source code before publishing this table. What isn't yet finalised is the exact hosting vendor and region for these entries. We are listing them rather than omitting them because Article 13(1)(f) requires disclosing the transfers we make, not only the ones we've fully documented, and because leaving a known gap off this table would be less honest than flagging it plainly. We will update the Status column and the date above as soon as they're confirmed. A previously-listed “Translation API provider (Global Reach)” row has been removed: a later review found Global Reach has no chat feature, so that row did not match what the product actually does. We are checking whether any comparable third-party processing exists elsewhere in our systems before publishing an accurate replacement entry.