Any queries please reach out to Donna or Craig
Microsoft Azure
Role
Cloud hosting provider and infrastructure platform.
Location of Processing
United Kingdom, European Economic Area, United States, Australia and Singapore (region selected by Controller).
Purpose of Processing
Hosting of the MyProgress application, databases, storage, networking and platform services.
Data Processed
All categories of personal data stored or transmitted within MyProgress.
Security & Compliance
ISO 27001, SOC 2 Type 2, GDPR-compliant infrastructure; physical and logical security; encryption services; access control frameworks.
Microsoft Azure Active Directory (B2C / Entra ID)
Role
Authentication and identity management provider.
Location of Processing
Regional Azure data centres selected by Controller.
Purpose of Processing
User authentication, identity verification and multi-factor authentication (MFA).
Data Processed
Identifiers, login credentials and access control metadata.
Security & Compliance
Integrated within Azure security and compliance framework.
Microsoft Email Delivery Services (Exchange / O365 / Azure Communication Services)
Role
Email delivery for system notifications.
Location of Processing
Regional cloud infrastructure selected by Controller.
Purpose of Processing
Outgoing email alerts, verification requests and password reset emails.
Data Processed
User contact details and system-generated notification content.
Security & Compliance
SPF, DKIM and DMARC enforced; Microsoft secure email gateway services.
Intruder.io
Role
External vulnerability scanning provider.
Location of Processing
United Kingdom / EU.
Purpose of Processing
Monthly vulnerability scans of MyProgress infrastructure to identify and remediate security weaknesses.
Data Processed
System configuration data, infrastructure metadata and security scan results.
Security & Compliance
Used for vulnerability management; no access to customer content or personal user data.
SendGrid (Transactional Email Delivery)
Role
Email relay service for high-volume transactional delivery.
Location of Processing
EU/US (subject to SCCs).
Purpose of Processing
Sending system-generated emails such as placement alerts and workflow notifications.
Data Processed
Recipient email addresses and message content.
Security & Compliance
SPF, DKIM and DMARC enforced; GDPR compliance frameworks in place.
MailGun (Transactional Email Delivery)
Role
Email relay service for high-volume transactional delivery.
Location of Processing
United Kingdom.
Purpose of Processing
Sending system-generated emails such as placement alerts and workflow notifications.
Data Processed
Recipient email addresses and message content.
Security & Compliance
SPF, DKIM and DMARC enforced; GDPR compliance frameworks in place.
Claude (Anthropic, PBC)
Role
AI-assisted investigation of support requests.
Location of Processing
United States.
Purpose of Processing
Named Supplier support personnel submit support ticket content, related application logs, diagnostic metadata and the results of read-only diagnostic queries. Claude uses these to analyse the issue, identify the likely cause and draft a resolution. Supplier personnel review all outputs before acting on them. The sub-processor has no credentials for, or direct access to, the MyProgress platform, its databases or customer systems. Any queries are run by Supplier personnel using their own access.
Data Processed
Support ticket content. This may include the email address and username of the person reporting the issue and of any affected users.
Application logs and diagnostic metadata: user, tenant and organisation identifiers, roles, timestamps, IP addresses and error details.
Results of diagnostic queries. These are limited to system identifiers and attributes. Personal details are included only where needed to identify the specific individual a ticket relates to.
Form or assessment content, only where that content is the subject of the ticket.
Security & Compliance
Provided under Anthropic's Commercial Terms and Data Processing Addendum. Customer content is not used to train models.
Inputs and outputs are kept for up to 30 days and then deleted.
Data is encrypted in transit (TLS) and at rest.
Anthropic holds SOC 2 Type II, ISO/IEC 27001 and ISO/IEC 42001 certifications.
Supplier controls: only named personnel have access. A mandatory data-minimisation policy requires identifiers rather than personal details, and bars personal information from persistent or shared outputs. All outputs are reviewed by a person before use.
Comments
0 comments
Article is closed for comments.