Sub-processors

1. 1.1Clause 7 of the data processing agreement gives CEDX general authorisation to engage sub-processors. This page is the list that authorisation refers to, and it forms part of that agreement.
2. 1.2A sub-processor is listed here if it may process personal data contained in customer data, whether or not it does so in practice for a given customer. A supplier that never touches customer data (an office cleaning contractor, for example) is not listed.
3. 1.3The list distinguishes between sub-processors engaged for every customer and those engaged only where a particular product or option is subscribed for. A customer that does not subscribe to a product is not subject to the sub-processors listed against it.
4. 1.4Where a sub-processor holds only encrypted data and has no ability to decrypt it, that is stated explicitly. Such a party is still listed, because we do not think the distinction should be ours to make quietly.
5. 1.5The version number of this page changes whenever an entry is added, removed or materially amended. The change history is in clause 8.

These parties provide the compute, storage and network capacity on which the platform runs. They are engaged for every customer. Data held with them is encrypted at rest with keys that they do not hold.

These parties support functions common to every application on the platform, authentication, observability, communications and support. They are engaged for every customer.

These parties are engaged only where the relevant product or optional capability is subscribed for. A customer that has not subscribed to the product is not subject to the sub-processor.

Affiliates within the CEDX group are sub-processors in their own right. They operate under an intra-group agreement incorporating the same obligations as the data processing agreement, and, where relevant, the Standard Contractual Clauses.

1. 6.1CEDX gives at least thirty days' notice before a new sub-processor begins processing customer personal data, and before an existing sub-processor's role is materially extended.
2. 6.2Notice is given by updating this page and by email to the notification address each customer has registered. Any number of addresses may be registered, and a distribution list is acceptable.
3. 6.3To register for notifications, write to privacy@cedxsystems.com from an address associated with the customer account, or add the address in the tenant's notification settings.
4. 6.4Removing a sub-processor, or narrowing what one may access, is not a change requiring notice. It is recorded in the change history in clause 8 in any event.
5. 6.5Where a sub-processor must be engaged at short notice to preserve the security or availability of the Services, CEDX may do so before the notice period expires. It will notify affected customers within one Working Day and explain why, and clause 7 continues to apply.

1. 7.1A customer may object to a new or replacement sub-processor within thirty days of notice, on reasonable grounds relating to data protection. Objections go to privacy@cedxsystems.com and should state the ground relied on.
2. 7.2CEDX will respond within ten Working Days, and will discuss the objection in good faith. Where possible it will offer a configuration change, a regional alternative or a workaround that avoids the sub-processor for that customer.
3. 7.3Where no reasonable alternative can be made available within thirty days of the objection, the customer may terminate the affected subscription on written notice and receive a refund of fees paid for the unused remainder of the subscription term.
4. 7.4An objection does not suspend the engagement of the sub-processor for other customers, and does not by itself entitle the objecting customer to withhold fees.

Every addition, removal and material amendment for the past two years. Entries are retained indefinitely and older ones are available on request.

1. 9.1Before a sub-processor is engaged it is assessed against a documented standard covering security certification, breach history, financial stability, transfer mechanisms and the enforceability of our contractual rights in its jurisdiction.
2. 9.2Every sub-processor is engaged under a written contract imposing obligations no less onerous than those CEDX owes its customers, including audit rights, breach notification within twenty-four hours and deletion on termination.
3. 9.3Every sub-processor is reassessed at least annually. Those with access to unencrypted customer personal data are reassessed twice a year and must provide a current independent assurance report.
4. 9.4CEDX maintains a transfer risk assessment for every sub-processor established outside the United Kingdom and the European Economic Area, reviewed annually and after any material change in the law of the recipient country.
5. 9.5A copy of the due diligence summary for any listed sub-processor is available to customers on request, with commercial terms redacted.
6. 9.6CEDX remains fully liable to the customer for the acts and omissions of every sub-processor listed on this page.