Sub-processors
Who "we" are. ISOXPERT is an independent consulting and technology firm under common ownership with Company Certification International (CCI), and the development and operations house for Compliance360, based in Karachi, Pakistan. The controller/processor entity is named in our Privacy Policy.
Our own establishment is a transfer too. Because the operating entity is in Pakistan — which is not covered by an EU or UK adequacy decision — access by our own staff to personal data relating to EEA, UK or GCC data subjects is an international transfer in its own right, alongside the sub-processors below. The mechanism that applies is set out in our Data Processing Agreement.
Third parties that process personal data on our behalf to deliver ISOXPERT Compliance360:
| Sub-processor | Purpose | Data categories | Location | Transfer basis |
|---|---|---|---|---|
| Supabase | Database, authentication, hosting | All application data (account, employee, compliance, audit logs) | Singapore (AWS ap-southeast-1) | SCCs (Supabase DPA) |
| Google (Gemini API) | AI drafting & analysis | Compliance content submitted to AI features | US / global | SCCs (Gemini API terms); paid API data not used for training |
| Stripe | Billing & payments | Org, plan, subscription metadata; card data handled by Stripe | US / global | SCCs (Stripe DPA) |
| Vercel | App hosting / serverless functions | Request data in transit; environment secrets | US (serverless functions) / global edge network | SCCs (Vercel DPA) |
| Resend | Transactional email notifications | Recipient names and email addresses; notification content (record titles, assignees, due dates) | US / global | SCCs (Resend DPA) |
| ERP integrations (SAP / Oracle / Odoo) | Optional customer-enabled data sync | Employees, customers, suppliers, products, assets, NCRs | Customer-controlled | Per customer's own agreements |
We notify customers before adding a new sub-processor, per our Data Processing Agreement.