Sub-processors

This page lists the third parties (sub-processors) that RiskFlag Ltd uses to process Customer Personal Data when it provides the RiskFlag platform. It forms part of the Terms and Conditions and its Personal Data Processing Addendum.

Last updated: 19 October 2026.

Platform

IONOS

What for: hosting the RiskFlag platform: the application, its databases, uploaded files and backups.

Where: United Kingdom.

Mailgun

What for: sending email from the platform, such as notifications, invitations and password resets. Mailgun receives the recipient's email address and the content of the email.

Where: European Union.

Geoapify

What for: address search and map locations. Geoapify receives the address or place name typed into a location field.

Where: European Union (Germany).

Google (Firebase Cloud Messaging)

What for: push notifications to the RiskFlag mobile app. Google receives the device's notification token and the text of the notification.

Where: Google's global network.

Apple (Apple Push Notification service)

What for: delivering those push notifications to iPhones and iPads.

Where: Apple's global network.

RiskFlag AI

Except where noted, these sub-processors are used only for organisations that have turned on RiskFlag AI. Data sent to them is not stored as part of normal processing and is discarded once processing is complete. It is never used to train or improve models. A request that a provider's automated systems flag as potential abuse may be kept for a limited period solely to investigate it.

Scaleway

What for: the main AI models used by the AI Features, and text recognition (OCR) of scanned documents. RiskFlag also uses Scaleway to analyse the platform's error reports, which may contain Customer Data, so that it can find and fix faults; this applies to every organisation.

Where: European Union (Paris, France).

Google Cloud (Vertex AI)

What for: backup AI models, used when the main models are unavailable.

Where: European Union.

Amazon Web Services (Amazon Bedrock)

What for: additional AI models.

Where: United Kingdom (London) and European Union.

The AI models these sub-processors host, and their licences, are listed on our AI Models and Licences page.

Not sub-processors

• RiskFlag's own systems. Document editing, search, virus scanning and error monitoring run on infrastructure RiskFlag operates itself, and backups are also kept on RiskFlag-owned hardware in the United Kingdom.
• Services the Customer connects. If the Customer signs in with Microsoft or Google, connects SharePoint, or connects its own AI provider, that provider acts under the Customer's own agreement with it, not as RiskFlag's sub-processor.
• AI model makers. The AI models RiskFlag uses run on the hosts above. The companies that make the models receive no data.

Changes

RiskFlag will update this page before adding or replacing a sub-processor, as set out in paragraph 8 of the Personal Data Processing Addendum. Questions about this list can be sent to info@riskflag.com.