Subprocessors List
As of July 2, 2026
KubernoGRC engages authorized third-party subprocessors to provide and support the Services. All subprocessors are subject to data protection obligations at least as protective as those in KubernoGRC’s Data Processing Addendum (DPA). This list is maintained in accordance with the DPA’s subprocessor notification obligations. Customers subscribed to subprocessor change notifications will receive at least 10 days’ advance notice before any new subprocessor is engaged to process Customer Personal Information.
Infrastructure Subprocessors
| Subprocessor | Entity Location | Purpose | Data Processed |
|---|---|---|---|
| Amazon Web Services (AWS) | United States | Cloud infrastructure — hosting, compute (ECS), database (RDS/PostgreSQL), caching (ElastiCache/Redis), object storage (S3), transactional email delivery (SES), AI model inference (Bedrock), logging/monitoring (CloudWatch), key management (KMS) | Customer Data, Personal Information, log data |
AI / Product Feature Subprocessors
| Subprocessor | Entity Location | Purpose | Data Processed |
|---|---|---|---|
| Anthropic, PBC | United States | AI features — LLM inference (e.g., SOC report analysis, questionnaire response generation) | AI Customer Input, AI Customer Output |
| OpenAI, L.L.C. | United States | AI features — text embeddings and LLM inference | AI Customer Input, AI Customer Output |
Business Operations Subprocessors
| Subprocessor | Entity Location | Purpose | Data Processed |
|---|---|---|---|
| HubSpot, Inc. | United States | Customer relationship management | Account Data, contact information |
Subprocessor Change Notification
KubernoGRC will provide at least ten (10) days’ advance written notice to Customers before engaging any new subprocessor or making material changes to an existing subprocessor that will affect the processing of Customer Personal Information. Notice will be provided via email to Customer’s designated privacy contact, or via update to this page.