Trust
Sub-processors
The third parties GBNOX engages to help deliver its services, what each one does, and where it processes data. Maintained as a live list, with 30 days' notice before anything changes.
01What a sub-processor is
A sub-processor is a third party we engage to process personal data on behalf of our customers — a hosting provider, an email service, a payment processor.
Every sub-processor on this page is bound by a written contract that imposes data protection obligations no less protective than those in our Data Processing Addendum. We remain fully liable to you for what they do.
This page is our Annex III for the purposes of the Standard Contractual Clauses.
02Current sub-processors
GBNOX products are pre-release. The list below covers the sub-processors engaged today for this website and our corporate operations. Before any GBNOX product processes customer data in production, this page will be updated with the complete production list, and existing customers will be notified in advance.
| Sub-processor | Purpose | Data processed | Processing location |
|---|---|---|---|
| Namecheap, Inc. | Website hosting, domain services and business email delivery for gbnox.com | Contact form submissions, email correspondence, server access logs | United States |
03Categories we expect to engage at launch
We publish the categories ahead of time so procurement teams can review them before we name a specific vendor. No vendor in these categories processes customer data today.
| Category | What it would do | Typical data |
|---|---|---|
| Cloud infrastructure | Compute, storage, networking and managed databases for the product | All Customer Data, encrypted at rest and in transit |
| Transactional email | Account verification, password reset, service notices | Name, email address, message content |
| Payment processing | Subscription billing, invoicing and tax calculation | Billing contact, billing address, tax ID. Card numbers go directly to the processor and never reach GBNOX. |
| Error and performance monitoring | Diagnosing faults and regressions | IP address, user agent, stack traces, user or tenant identifier |
| Customer support tooling | Managing support conversations | Name, email address, conversation content |
| AI model providers | Generating scores, summaries and recommendations on request | Only the content needed for the request. Contractually barred from training on our customers' data. |
04GBNOX affiliates
GBNOX does not currently engage any affiliate entity as a sub-processor. If that changes, the entity, its role and its location will be listed here before it begins processing.
05How we notify you of changes
Before adding or replacing a sub-processor that processes customer personal data, we give at least 30 days' notice.
- The change is published here first, with a revised "last updated" date.
- Customers who subscribe receive an email. To subscribe, use the contact form with the subject "Sub-processor notifications".
- Account administrators are notified in-product once the product ships.
06Objecting to a sub-processor
You may object to a new sub-processor on reasonable data protection grounds within 30 days of the notice.
- Use the contact form explaining the grounds.
- We will work with you in good faith to find an alternative — a different vendor, a different region, or a configuration change.
- If no reasonable alternative exists, you may terminate the affected part of your subscription and we will refund the unused portion of prepaid fees on a pro-rata basis.
We will not treat an objection as a breach, and we will not charge you a termination fee for exercising this right.
07International transfers
Where a sub-processor processes personal data outside the EEA, the UK or Switzerland, the transfer is covered by the Standard Contractual Clauses, the UK International Data Transfer Addendum, or an applicable adequacy decision, as described in the Data Processing Addendum.
Copies of the relevant transfer mechanisms are available on request through the contact form.