Your data
Subprocessors
Every vendor that may process customer data on our behalf, what each one does, and how we notify you before the list changes.
This page lists the third parties that may process customer data on our behalf in providing CogniWork. It is referenced by the DPA and forms part of it.
How changes work
We give at least 30 days’ notice before adding or replacing a subprocessor that processes customer data. Notice is given by updating this page and emailing workspace owners.
If you object on reasonable data-protection grounds within that window and we cannot resolve it, you may terminate the affected service without penalty — see DPA § Subprocessors.
To be notified of changes, email [email protected] with the subject “subprocessor notifications”.
Infrastructure
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, compute and storage for the service | All customer content at rest and in processing | United States |
| Cloudflare, Inc. | Content delivery, TLS termination, DDoS and bot mitigation | Network traffic metadata; content in transit | Global edge network |
AI model providers
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Anthropic PBC | Large language model inference for the assistant, AI workers and workflow AI steps | Prompts and the workspace content required to answer them | United States |
Model providers process content under enterprise API terms that prohibit training on customer data. See the AI Disclosure.
Platform services
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Authgear Limited | Authentication and identity — sign-in, session management, multi-factor | Account identifiers, email addresses, authentication events | United States / Hong Kong |
Services you choose to connect
When you connect an integration or a messaging channel, the provider of that system processes the data you direct CogniWork to send it. Those providers are not our subprocessors — you engage them directly, under their terms, using credentials you supply.
Examples of what this covers: MCP servers you install, and messaging channels such as Telegram, WhatsApp, Signal or iMessage. You choose them, you scope their access, and you can disconnect them at any time.
Our own personnel and contractors
Our staff and any contractors are bound by confidentiality obligations and access customer data only as described in AI Disclosure § Human review.