Security & Privacy
Sub-processors and locations
The third parties that receive data because the product is built on them, what each receives, and where processing actually happens.
This list is derived from the code, not from a vendor inventory.
| Recipient | Why | What it receives |
|---|---|---|
| Google (Gmail) | Sending and receiving assessment and enquiry email | Your name, email address, and the content of messages, including your secure onboarding link |
| GitHub, Inc. | Running the assessment. It executes as a workflow on GitHub-hosted infrastructure, which is also where the evidence set and the finished board pack are held until GovIntel retrieves them | Your company name, the role assumed, your region, the evidence collected from your environment, and the board pack |
| Amazon Web Services | Storing the finished board pack, and hosting the template you deploy. GovIntel's own infrastructure runs on AWS | The board pack, and everything in the operational database |
| Google Analytics 4 | Measuring use of the public website | Page views and a small number of interaction events on public pages. Not loaded on the customer onboarding pages |
Data is also disclosed where the law requires it, and to professional advisers under a duty of confidence. It is not otherwise shared.
Where processing happens
The operational database and the storage holding your board pack are in the AWS Asia Pacific (Mumbai) region, in India.
The assessment itself runs on GitHub-hosted infrastructure, and email is handled by Google. Neither is confined to a single country, and both mean your data is processed outside India, and outside the EU, the UK and your own country.
Your AWS environment is read in whichever regions you have enabled.
What is not claimed
GovIntel does not claim standard contractual clauses, an international data transfer agreement, or a completed transfer assessment. The transfers are described rather than papered over.