Zafran Security, Inc. (“Zafran”) engages the subprocessors listed below to help provide, secure, support, and improve its services. The process for objecting to a new subprocessor is set out in Zafran’s Data Processing Agreement (DPA), which is either published at http://www.zafran.io/legal/dpa-platform or set forth in your signed contracting documents and forms part of the customer agreement.
AI model providers. Subprocessors marked “AI” below provide the foundation-model capabilities behind Zafran’s AI Functionalities. Consistent with Zafran’s customer terms, Zafran does not use Customer Data or customer inputs to train third-party foundation models, and does not permit these providers to do so.
| Subprocessor | Type | Purpose / processing activity | Data categories | Location |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure | Hosting and operation of the Service; storage and compute | Customer Data; Account Data | For Zafran customer tenants hosted in the US or the EU/Switzerland, processing will be performed in the US or the EU/Switzerland (respectively). For Zafran tenants hosted in other regions, depending on the service options, processing will be either in the US or the EU/Switzerland or in a region that is geographically closer to the Zafran customer tenant region. |
| Amazon Web Services – Amazon Bedrock (AI) | AI model hosting (Bedrock) | Hosted access layer through which certain AI models are called | Inputs/prompts submitted to AI features | EMEA Region Customers - Switzerland; USA and all other Regions Customers - United States |
| Google Cloud Platform | Cloud infrastructure | Hosting and operation of the Service; storage and compute | Customer Data; Account Data | United States |
| Google Cloud Platform (AI) | AI model hosting | Hosted access layer through which certain AI models are called | Inputs/prompts submitted to AI features | United States |
| Microsoft Azure | Cloud infrastructure | Hosting and operation of the Service; storage and compute | Customer Data; Account Data | United States |
| Microsoft Azure OpenAI (AI) | AI model hosting | Hosted access layer through which certain AI models are called | Inputs/prompts submitted to AI features | United States |
| Cloudflare, Inc. | Web application firewall | Edge security and WAF protection for the Service | Network and request metadata | Global (per customer location) |
| Datadog, Inc. | Monitoring | Performance monitoring, logging, and security telemetry | Account Data; operational logs | United States |
| Descope, Inc. | Authentication | Authentication and storage of user identifiers | User identifiers and authentication metadata | EMEA Region Customers - Germany; USA and all other Regions Customers - United States |
| Confluent, Inc. | Managed streaming | Managed Kafka event streaming | Account Data in transit | EMEA Region Customers - Switzerland; USA and all other Regions Customers - United States |
| ClickHouse, Inc. | Managed database | Managed analytics database | Account Data; findings metadata | EMEA Region Customers - Germany; USA and all other Regions Customers - United States |
| Zafran Security, Ltd. (Affiliate) | Affiliate – R&D & support | Research, development, hosting operations, and technical support for Zafran Security, Inc. | Customer Data and Account Data, as needed | Israel |
Entries marked “AI” are foundation-model or AI-hosting providers. Where Customer contracts directly with a Zafran Affiliate, that Affiliate is a party to the agreement and not a sub-processor. Locations indicate primary processing regions and may include other regions for resilience.