Security Standards · Trust Center
Subprocessor Register
Every third party Ascendo AI engages to help deliver and operate our platform: what each one does, what data it touches, and where that data is processed.
A subprocessor is any third party Ascendo AI engages to process customer data on our behalf in order to provide the Ascendo platform. This register lists every subprocessor currently in use, organized by what they do, what kind of data they touch, and where that processing happens.
We review every subprocessor before onboarding and at least once a year after that, require a written data processing agreement from each one, and tell customers about material changes. Questions about a specific entry or this register can go to security@ascendo.ai.
No subprocessors match that search. Try a different term or clear the filter.
Cloud Infrastructure & Hosting
3 subprocessorsThe compute, storage, and hosting layer our platform and AI workloads run on.
| Subprocessor | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
Google Google Inc. | Cloud compute and storage on Google Cloud Platform, including self-hosted PostgreSQL database infrastructure | Customer and case data processed for hosting, storage, and database operations | HQ: Mountain View, CA, USA Multiple US data center regions; processing limited to the US and EU | Active |
MongoDB Atlas MongoDB, Inc. | Managed cloud database (MongoDB Atlas) for operational and application data storage | Customer application data, case records, configuration data | HQ: New York, NY, USA Multiple US/EU regions, per deployment configuration | Active |
Vercel Vercel Inc. | Hosting and content delivery for Ascendo's web application and front-end | Application traffic, session and authentication data; no case content stored | HQ: San Francisco, CA, USA Global edge network; primary regions in the US | Active |
AI & Embedding Model Providers
2 subprocessorsModel APIs we call to turn case and knowledge content into embeddings and generate AI-assisted responses.
| Subprocessor | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
OpenAI OpenAI, L.L.C. | AI model and embedding API processing to support natural-language understanding and generation | Text content submitted for AI processing and embedding generation | HQ: San Francisco, CA, USA Processing region: United States | Active |
Voyage AI Voyage AI Innovations, Inc. | Embedding model API (Voyage 3 and successor models) for semantic and vector search | Text content submitted for embedding generation | HQ: Palo Alto, CA, USA Processing region: United States | Active |
Data & Search Infrastructure
1 subprocessorThe vector search engines that store and retrieve your data. Some run inside our own Google Cloud environment; others are managed cloud services, noted per row below.
| Subprocessor | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
Qdrant† Qdrant Solutions GmbH | Vector database for similarity search and retrieval | Vector embeddings and associated metadata | HQ: Berlin, Germany Self-hosted on Google Cloud, or Qdrant Cloud; varies by deployment | Active |
† Qdrant runs either as a self-hosted instance inside Ascendo's own Google Cloud Platform environment, or via Qdrant Cloud, depending on the deployment. Where self-hosted, the provider itself does not receive or process customer data.
Business Operations & Support Tools
4 subprocessorsThe systems our finance, support, and delivery teams use day to day.
| Subprocessor | Purpose | Data processed | Location | Status |
|---|---|---|---|---|
Sage Intacct Sage Intacct, Inc. (The Sage Group plc) | Cloud ERP for finance and accounting operations | Financial data, including customer information, vendor data, and employee details | HQ: Redwood City, CA, USA Processing region: United States | Active |
Atlassian Atlassian Corporation | Customer support ticketing (Jira Service Management) and internal project & documentation management (Jira, Confluence) | Customer support tickets and communications; internal project and documentation data | HQ: Sydney, Australia / San Francisco, CA, USA Processing regions: United States and Australia | Active |
Twilio Twilio Inc. | Communications platform for SMS, voice, and customer outreach, plus transactional and notification email delivery via SendGrid | Customer contact information (name, email, phone number), message content, and delivery metadata | HQ: San Francisco, CA, USA Processing region: United States | Active |
Zendesk Zendesk, Inc. | CRM and support ticketing platform | Customer service data, including support tickets, contact information, and communication history | HQ: San Francisco, CA, USA Processing region: United States | Active |
Affiliates
Before onboarding
Written agreements
Every subprocessor that touches customer data signs a data processing agreement with confidentiality, security, and breach-notification terms that match or exceed what we commit to in our own customer agreements.
On a schedule
Security review
We review each subprocessor's security certifications (SOC 2, ISO 27001, or equivalent) before granting access, and again at least once a year or whenever their service changes in a way that affects how data is handled.
By design
Least privilege
Each subprocessor receives only the data and access required for its specific function. Where it's practical, we minimize or scope data before it ever reaches a subprocessor's systems.
Some subprocessors rely on their own sub-processors, most often underlying cloud infrastructure, to deliver their service. Our agreements require the same data-protection obligations to flow down to those sub-processors.
International data transfers
Some subprocessors process data outside the region where it originated. Where that happens, we rely on Standard Contractual Clauses or another lawful transfer mechanism, consistent with our GDPR commitments. See our Data Processing Agreement and GDPR page for the contractual detail.
Have questions?
Our security team can answer questions about subprocessors, data handling, or any concerns you may have about this register.