Sub-processors
Last updated: 28 October 2026
OnCloud Ltd. uses a small number of third-party providers (sub-processors) to run Griffin31. A sub-processor is a provider that processes personal data of our customers’ users on our behalf.
We keep the personal data we collect to a minimum. From your Microsoft 365 tenant, Griffin31 reads only user principal names (UPNs) and the Microsoft security signals needed for recommendations. Email, file, chat and document content is never read. All customer data is hosted in Microsoft Azure in the EU (North Europe, Ireland).
Each sub-processor is bound by a data processing agreement and is assessed for security before we engage it and every year after. Our Data Processing Addendum sets out these commitments in full.
Current sub-processors
Section titled “Current sub-processors”| Sub-processor | Purpose | Personal data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Microsoft Azure | Hosting, storage and database | All customer data, encrypted at rest | North Europe (Ireland) | Within the EU |
| Microsoft Entra ID | User sign-in and admin consent | Identity information used for sign-in | European Union | Within the EU |
| Datadog | Application monitoring and logs | Operational logs that may contain identifiers | European Union | Within the EU |
| Cloudflare | DNS, encryption in transit (TLS) and web application firewall | Data in transit only | Global edge network | EU–US Data Privacy Framework |
| Postmark | Notification emails (invitations and alerts) | Recipient email address only. Emails contain a link to Griffin31, no security findings or other personal data | United States | Standard Contractual Clauses |
Other tools OnCloud uses to run its business, such as source control and password management, receive no customer personal data and are not sub-processors.
Changes to sub-processors
Section titled “Changes to sub-processors”We email your account owner at least 30 days before a new sub-processor starts processing customer personal data. This page is updated at the same time.
If you have a reasonable data protection concern about a new sub-processor, you can object in writing within those 30 days by emailing privacy@griffin31.ai. We’ll work with you in good faith to resolve it. If we can’t, you may terminate the affected service, as set out in our Data Processing Addendum.
Contact
Section titled “Contact”- Privacy questions: privacy@griffin31.ai
- Security issues: support@griffin31.ai