Subprocessors

When you use ComplianceLint, KI·SUM·AI - Kisum GmbH (the “controller”) engages a small number of third-party service providers to deliver, secure, and bill for the service. Under Art. 28 GDPR, these are subprocessors — they process personal data only on our documented written instructions.

This page is the canonical list. The privacy policy at /legal/privacy §5 contains the same information embedded in the broader privacy disclosure; this page exists so customers and their compliance counsel can audit the current subprocessor list at a single stable URL.

We will provide advance written notice of any change to this list (addition, removal, or material change of role) before the change takes effect. Customers may object to a new subprocessor under the terms of their service agreement; if no reasonable accommodation is possible we will offer termination consistent with applicable contract terms.

Each subprocessor below is bound by an executed Data Processing Agreement (Art. 28 GDPR) or equivalent. For international transfers outside the EEA, where applicable we rely on the European Commission's Standard Contractual Clauses (SCCs), the EU–U.S. Data Privacy Framework (where the recipient is certified), and supplementary technical and organisational safeguards as required by Chapter V GDPR.

The following are not subprocessors of ComplianceLint:

• LLM inference providers (Anthropic, OpenAI, etc.). The ComplianceLint scanner runs inside your IDE and uses your own API key with the provider of your choice. No customer source code is sent to an LLM by our SaaS dashboard. Customer-LLM is a direct controller-to-processor relationship under the customer's own contract with the provider.
• Advertising networks. ComplianceLint does not run advertising. We do not share personal data with ad networks, retargeting providers, or programmatic advertising services.
• Customer source code. Findings produced by the scanner are JSON classifications (obligation IDs, status flags, evidence references). We do not transmit, store, or process customer source code on SaaS infrastructure.

For each subprocessor above, KI·SUM·AI - Kisum GmbH maintains internally:

• An executed copy of the Art. 28 Data Processing Agreement
• The provider's Technical & Organisational Measures (Art. 32 GDPR)
• SCCs or DPF certification evidence where applicable
• The audit-cycle date of last review

These documents are available on written request from the data controller of any customer organisation; please email info@compliancelint.com with your account email and your role at the controller organisation.

Before any new subprocessor begins processing your personal data, we will notify you in writing — either via the email address on your account, or via an in-product announcement that requires acknowledgement before continued use of the service. We aim to provide at least 14 days advance notice for non-urgent changes; for changes required by security or regulatory necessity (e.g. an upstream provider mandates an updated DPA), the notice may be shorter and we will explain the cause.

You may object to the use of a new subprocessor under the terms of your service agreement. If we cannot reasonably accommodate your objection, we will offer termination of the affected service consistent with applicable contract terms; a pro-rated refund is available where contractually required.

For subprocessor-related questions, audit requests, or objection notices, please email info@compliancelint.com with subject line “Subprocessor inquiry”.