---
title: "List of sub-processors"
slug: "list-of-sub-processors"
tags: ["admin", "integration", "Proctorio", "ProctorU", "Turnitin", "ReadSpeaker", "SOWISO"]
updated: 2026-05-28T11:22:39Z
published: 2026-05-28T11:22:39Z
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.cirrusassessment.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List of Sub-Processors

## Sub-processor definition

In support of our Data Protection Agreement we maintain a list of "Sub-Processors" - defined as other Data Processors *contracted by Cirrus* to process *"Personal Data"* to support *servicing* you as *a Customer* (Data Controller).

- If a partner contracted by Cirrus does NOT process "Personal Data", better known as "Personal Identifiable Information" or PII, they are NOT a Data Processor under the GDPR and therefore not a Sub-Processor under our Data Protection Agreement.
- If a Partner is contracted directly by the Customer, they are NOT (a Sub-Processor) in scope of the *Cirrus* Data Protection Agreement.

              Complete list of partners including compliance info

              

For completeness we have also listed those partners and marked them "(Out-of-Scope)". We provide up-to-date direct links to our partners Compliance information ("Compliance Info").

For some Sub-Processors Cirrus merely links to another website without sending any (user)data, these are marked "IP address only". Note that an IP address must be considered as PII, see [EU - What is personal data?](https://commission.europa.eu/law/law-topic/data-protection/reform/what-personal-data_en).

#### List of platform uRLs

              
              

For the [list of URLs](/api/docs/cirrus-platform-urls) used by the Cirrus Platform refer to the [Cirrus Platform URLs](/api/docs/cirrus-platform-urls) article in our developers portal

## Cirrus end-users

In this section we list Sub-Processors processing data for our end-users; users of the Cirrus Platform.

### Core sub-processors

Sub-Processors that are core to the Cirrus Platform.

| Sub-Processor | Purpose | Country/Location | Compliance Info | Status Page | Remarks |
| --- | --- | --- | --- | --- | --- |
| **Amazon AWS** | Facilitate Assessment Process - **Hosting Customer Data** | EU: Ireland/Dublin (and Stockholm/Sweden), AU: Australia/Sydney, CA: Montreal/Canada, SG: Singapore/Singapore | [AWS Compliance](https://aws.amazon.com/compliance/), Useful links: [AWS ISO/IEC 27001](https://aws.amazon.com/compliance/iso-27001-faqs/), [AWS ISO/IEC 27017](https://aws.amazon.com/compliance/iso-27017-faqs/), [AWS ISO/IEC 27018](https://aws.amazon.com/compliance/iso-27018-faqs/), [AWS SOC](https://aws.amazon.com/compliance/soc-faqs/), [AWS GDPR DPA](https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf) | [AWS Health](https://health.aws.amazon.com) | The most important sub processor as it hosts the Cirrus Platform including its Customer Data. NOTE: For your convenience we have added useful links to the AWS pages containing their ISO certificates (e.g. "AWS ISO/IEC 27001:2013 Certification"), SOC 3 report ("AWS SOC 3 Security, Availability & Confidentiality Report") and [AWS GDPR DPA](https://d1.awsstatic.com/legal/aws-gdpr/AWS_GDPR_DPA.pdf) (Data Processing Agreement). EU Stockholm is a backup location for EU Premium. |

### Optional sub-processors

Customers (Data-Controllers), in particular Customer System Administrators in Cirrus may enable optional Sub-Processors.

| Sub-Processor | Purpose | Country/Location | Compliance Info | Status Page | Remarks |
| --- | --- | --- | --- | --- | --- |
| Document360 | Facilitate Assessment Management - Provides Help Widget - Help Centre / Knowledge Base | [Global, incl. India](https://document360.com/gdpr-compliance/), see [Azure global infrastructure](https://azure.microsoft.com/en-us/explore/global-infrastructure/) plus Global CDNs ([Stackpath (OpenJSF)](https://www.stackpath.com/platform/edge-locations), [JSDeliver](https://www.jsdelivr.com/network), [Google Fonts](https://www.google.com/about/datacenters/locations/), [CloudFlare (FontAwesome)](https://www.cloudflare.com/network/) locations) | [Document360 GDPR](https://document360.com/gdpr-compliance/) plus CDNs ([OpenJSF](https://privacy-policy.openjsf.org/), [JSDeliver](https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net), [Google Fonts](https://developers.google.com/fonts/faq/privacy), [FontAwesome](https://fontawesome.com/privacy) privacy policies) | [status.document360.com](https://status.document360.com/) | IP Address only - NOTE: Author/admin can activate this by clicking **(?)** or seeking [help](/docs/help.cirrusassessment.com) |
| ImgIX | Facilitate Assessment Process - Process images | **AWS Region**, USA | [Privacy Policy](https://imgix.com/privacy) | [status.imgix.com](https://status.imgix.com/) | IP Address only. NOTE: Author can upload images that need to be resized. All (image) data is stored in the AWS Region of the Cirrus Platform, see **Amazon AWS** above. |
| webspellchecker.net | Facilitate Assessment Process - Provide Spell-checking service alternative for Browser build-in | US (Virginia) | [webspellchecker Compliance](https://webspellchecker.com/legal/). | [status.webspellchecker.com](https://status.webspellchecker.com/) | NOTE: Author can enable this spell-checking for Essay questions. |

### Add-on sub-processors

Customers (Data-Controllers) may subscribe to use additional "Add-On" Sub-Processors.

| Sub-Processor | Purpose | Country/Location | Compliance Info | Status Page | Remarks |
| --- | --- | --- | --- | --- | --- |
| Proctorio | Facilitate Exams - Remote proctoring | US: US, EU: EU, see [Proctorio Privacy](https://proctorio.com/privacy) and [AWS global infrastructure](https://aws.amazon.com/about-aws/global-infrastructure/) / [Azure global infrastructure](https://azure.microsoft.com/en-us/explore/global-infrastructure/) | [Proctorio Compliance](https://proctorio.com/privacy/compliance) / [ISOs / SOC 2](https://proctorio.com/privacy/audits) / [Release Notes](https://changes.proctorio.com/) | [uptime.proctorio.com](https://uptime.proctorio.com/) | If and only if contracted through Cirrus is Proctorio a Sub-Processor. |

### Sub-contractors (Out-of-scope)

If a Sub-Contractor does **NOT** process "Personal Data", better known as Personal Identifiable Information or PII, they are by definition *not* a "Data Processor" under the GDPR and *not* a Sub-Processor under our Data Privacy Agreement.

| Sub-Contractor | Purpose | Country/Location | Compliance Info | Status Page | Remarks |
| --- | --- | --- | --- | --- | --- |
| Sowiso | Facilitate Exams and Marking - Process Math answers | Netherlands | [Information Security Policy](https://sowiso.nl/en/information-security-policy/) / [Privacy Policy](https://sowiso.nl/pdf/Privacy_Policy_SOWISO_and_Bolster_Academy.pdf) / [Release Notes](https://help.sowiso.com/en/collections/2226212-release-notes) | ? | No PII. (No IP address in Server-to-Server) |

### Customer sub-contractors (Out-of-scope)

If a Partner is contracted directly by the Customer they are *not* in scope of the *Cirrus* Data Protection Agreement.

| Partners | Purpose | Country/Location | Compliance Info | Status Page | Remarks |
| --- | --- | --- | --- | --- | --- |
| Ecobit | Facilitate Marking - Scanning printed answers (Print & Scan) | Netherlands | [Ecobit DPA](https://ecobit.nl/images/bestanden/Verwerkersovereenkomst-Ecobit.pdf) |  | Candidate name and signature |
| Proctorio | Facilitate Exams - Remote proctoring | US: US, EU: EU, see [Proctorio Privacy](https://proctorio.com/privacy) and [AWS global infrastructure](https://aws.amazon.com/about-aws/global-infrastructure/) / [Azure global infrastructure](https://azure.microsoft.com/en-us/explore/global-infrastructure/) | [Proctorio Compliance](https://proctorio.com/privacy/compliance) / [Release Notes](https://changes.proctorio.com/) | [uptime.proctorio.com](https://uptime.proctorio.com/) | If contracted directly by Customer. |
| ProctorU | Facilitate Exams - Remote proctoring |  | [ProctorU Compliance](https://www.proctoru.com/compliance) |  | Contracted directly by Customer. |
| Readspeaker | Facilitate Exams - Reading Cirrus/Exam texts out loud | Netherlands | [Privacy Policy](https://www.readspeaker.com/privacy-policy/) / [Release Notes](https://announcements.readspeaker.com/release-notes/) | ? | IP address only |
| TurnItIn | Facilitate Marking - Plagarism Detection | US, EU, APAC | [TurnItIn Privacy and Security](https://help.turnitin.com/Privacy_and_Security/) | [TurnItIn Status](https://turnitin.statuspage.io/) | Contracted directly by Customer |

## Cirrus service management

For completeness we also include our Cirrus Service Management tooling used by Cirrus to collaborate with Customer's Super Users and other contacts.

### Service management sub-processors

| Sub-Processor | Purpose | Country/Location | Compliance Info | Status Page | Remarks |
| --- | --- | --- | --- | --- | --- |
| Airtable | Facilitate Service Management - Store Service information | Virginia, US (AWS) | [Airtable Security](https://www.airtable.com/security) [Airtable Privacy](https://www.airtable.com/privacy) | Email and names of service contacts. |  |
| Atlassian | Facilitate Service Management - Notify subscribers of Status Page updates | Ireland/Dublin, Germany/Frankfurt, USA/N. California | [Atlassian Compliance](https://www.atlassian.com/trust/compliance), [Atlassian GDPR](https://www.atlassian.com/trust/privacy/country/europe-and-gdpr) | [metastatuspage.com](https://metastatuspage.com/) | Only email of email notification subscribers. |
| Atlassian | Facilitate Service Management - Customer Portal, report and track requests | Ireland/Dublin, Germany/Frankfurt, USA/N. California | [Atlassian Compliance](https://www.atlassian.com/trust/compliance), [Atlassian GDPR](https://www.atlassian.com/trust/privacy/country/europe-and-gdpr) | [jira-service-management.status.atlassian.com](https://jira-service-management.status.atlassian.com/) | Email and optionally name of request participants. |
| Document360 | See Document360 under [Optional Sub-Processors](/docs/list-of-sub-processors#optional-subprocessors) | Provides Help Centre / Knowledge Base (and Help Widget) | See Document360 | See Document360 under [Optional Sub-Processors](/docs/list-of-sub-processors#optional-subprocessors) | See Document360 under [Optional Sub-Processors](/docs/list-of-sub-processors#optional-subprocessors) |
| Google Workspace | Facilitate Service Management and Project Collaboration - Provide Mail, Document and Videoconferencing | Global, see [Google data centre locations](https://www.google.com/about/datacenters/locations/) | [Google Cloud Compliance EU](https://cloud.google.com/security/compliance/offerings?hl=en_GB#/regions=EMEA&industries=All_industries) | [Workspace Dashboard](https://www.google.com/appsstatus/dashboard/) |  |
| Mailchimp | Facilitate Service Management - Mail Service and Product update information | US | [Mailchimp GDPR & Compliance](https://mailchimp.com/gdpr/) | Only for recipients; Email and consent, optionally first name of newsletter recipients. |  |
| Pipedrive | Facilitate Service Management - Store Service and Product update information | US and EU, see [Rackspace Data Centres](https://www.rackspace.com/en-nl/about/data-centres) | [Pipedrive Privacy & Security](https://www.pipedrive.com/en/features/privacy-security) | Email and consent, optionally name of newsletter recipients. |  |
| Slack | Facilitate Service Management and Project Collaboration - Provide Instant Messaging | United States, Australia, Canada, France, Germany, India, Japan, South Korea, United Kingdom, See [Slack Subprocessors](https://slack.com/slack-subprocessors) | [Slack Compliance](https://slack.com/trust/compliance) | [status.slack.com](https://status.slack.com) | Optional. |
| WeFact | Invoicing | EU | [WeFact Veiligheid](https://www.wefact.nl/veiligheid/) | Invoice contact name and email |  |