Security
Subprocessors
Effective date: [effective date]
The third parties that process customer data for SparkFlow, what each does, the data it handles and where it does it.
Before publication: the founder confirms this list, and the no-training and zero-retention terms on file, before this page goes live.
Contents
The list
| Subprocessor | Purpose | Data category | Region |
|---|---|---|---|
| Google Cloud | Hosting for your company’s isolated environment and for SparkFlow’s own service: computing, storage, databases, encryption keys and logs | Your company’s content, under its own key; account records: an identifier from the sign-in service, a one-way hash of the email address, roles and seats; diagnostics that carry no content | Canadian regions |
| Google Cloud | The model engine, under no-training and zero-retention terms | The content one request needs: a question and the passages that answer it, a markup page or its text, an instruction, the drawing facts it concerns, or the text of a standard being indexed | Canada |
| Amazon Web Services | Email notices about your company’s service, to your administrators alone | Your administrators’ email addresses, read from the sign-in service when a notice is sent and never stored by SparkFlow, and the notice’s fixed words and references, never your content | Canada |
| Google Cloud | Sign-in through your company’s identity provider, with multi-factor authentication | Members’ sign-in identities, email addresses and authenticator enrolments | [the region where Identity Platform holds sign-in identities] |
What is not on it
Services that never receive customer data are not subprocessors and are not listed, such as the code host that holds SparkFlow’s own source and the font service this website loads its typeface from. No payment provider is listed, because no payment happens inside SparkFlow.