Sub-processors

Last updated Tuesday 23rd June 2026

ThreatSabre Limited engages the third-party sub-processors listed below to process Customer Personal Data in connection with delivering the ThreatSabre platform. Each sub-processor is engaged under a written Data Processing Agreement (DPA) imposing data protection obligations substantially equivalent to those in our own Data Processing Agreement, with EU Standard Contractual Clauses, the UK Addendum, and/or EU-U.S. Data Privacy Framework reliance where applicable for international transfers.

This page is the canonical, current list of sub-processors referenced in Appendix 2 of our Data Processing Agreement.

Current sub-processors

Sub-processor	Purpose	Location	Transfer mechanism
AWS	Cloud infrastructure (compute, database, storage)	Australia (Sydney; Melbourne for backups)	AWS DPA + EU SCCs
Kinde	Authentication and identity	Australia	AU data residency
Cloudflare	CDN, DNS, WAF, DDoS and bot protection	Global edge network	DPA + EU SCCs, UK Addendum, EU-U.S. DPF
Resend	Transactional email and notification delivery	United States	EU-U.S. DPF + SCCs
PostHog	Website analytics (anonymised, no PII)	United States	DPA + EU SCCs
Microsoft 365	Corporate email, collaboration, and support correspondence	New Zealand	DPA + EU SCCs + EU-U.S. DPF
Zoho	CRM, customer support, demo bookings	Australia	AU data residency

Note: not all sub-processors process all categories of Customer Personal Data. AWS hosts the platform and therefore processes the full set of Customer Personal Data; the others process only the data necessary for their stated purpose.

Changes to sub-processors

We will notify customers of any intended addition or replacement of a sub-processor, giving the opportunity to review the change, as set out in clause 6 of our Data Processing Agreement. To subscribe to sub-processor change notifications, contact support+privacy@threatsabre.com.

For more detail on how we process personal data, see our Privacy Policy.