Sub-Processors

Details of our Sub-Processors

Before engaging with a Sub-Processor, Red Sift takes deliberate steps to conduct an assessment of risk arising from this third-party relationship. Any potential sub-processors are expected to demonstrate their security policies, processes, and procedures and prove that they are able to provide adequate protection of such data in line with our information security policy.

For more information about how we engage with Sub-Processors and details of the Personal Data we Process on behalf of our customers – please refer to our Red Sift Data Processing Addendum. Unless stated otherwise, capitalized terms used on this page have the meanings set out in that Data Processing Addendum.

Note: Where the Red Sift DORA Addendum is incorporated into the Agreement between Red Sift and its Customer, any references on this page to “Personal Data” should be read as also including a reference to “Customer Data”.

Entity Name	Products	Type of Entity & Sub-Processing Activities	Types of Personal Data Processed	Data Processing Region	Technical and Organizational Measures
Anthropic, Inc	All	AI-powered natural language processing	Any Personal Data that is provided to or accessed by Red Sift Personnel and used as part of the Support Services	USA	Anthropic Compliance ISO 27001 ISO 42001 SOC2 Type 2
IBM United Kingdom Limited	Default/ UK +EU data residency option All	Data hosting and infrastructure: Cloud services provider and data storage	Any Personal Data Processed by Red Sift as part of those elements of the Services hosted by such Sub-Processor	UK & Germany	IBM Cloud Compliance ISO27701 ISO27001 SOC2 TYPE 2 DPA/ SCC's
Intercom, Inc.	OnDMARC Brand Trust BIMI Maker	Customer Support Services: web chat (Please note - this service can be disabled)	Any Personal Data that is provided to or accessed by Red Sift Personnel as part of communications, chats etc (together with associated materials, documents and artifacts) as part of the Support Services	USA	Intercom Compliance ISO27001 SOC2 TYPE 2 DPA/ SCC's
Microsoft Corporation	EU data residency option only: Red Sift Pulse Platform Radar OnDMARC	Data hosting and infrastructure: Cloud services provider and data storage	Any Personal Data Processed by Red Sift as part of those elements of the Services hosted by such Sub-Processor	Netherlands	Azure Compliance ISO27001 ISO27701 SOC2 TYPE 2 DPA/ SCC's
Microsoft Corporation	USA data residency option only: Red Sift Pulse Platform Radar OnDMARC	Data hosting and infrastructure: Cloud services provider and data storage	Any Personal Data Processed by Red Sift as part of those elements of the Services hosted by such Sub-Processor	USA	Azure Compliance ISO27001 ISO27701 SOC2 TYPE 2 DPA/ SCC's
Salesforce, Inc.	All	Support Services: Customer Support Services file and ticket management	Any Personal Data that is comprised in files and tickets etc submitted to Red Sift as part of the Support Services	UK	Salesforce Compliance ISO27001 SOC2 TYPE 2 DPA/ SCC's
Open AI, L.L.C	All	AI-powered natural language processing	Any Personal Data submitted to Radar and AI Agent (including as inputs and prompts); Any Personal Data that is provided to or accessed by Red Sift Personnel and used as part of the Support Services	USA	Open AI Compliance ISO27001 ISO 42001 SOC2 TYPE 2 DPA/ SCC's
Incopro Limited	Brand Trust – Notice and Takedown Services	Brand protection services (including notice and takedown services)	Any Personal Data submitted as part of the Brand Trust – Notice and Takedown Services	USA	Incopro Compliance ISO27001 DPA/ SCC's
OpSec Online LLC	Brand Trust – Notice and Takedown Services	Brand protection services (including notice and takedown services)	Any Personal Data submitted as part of the Brand Trust – Notice and Takedown Services	USA, Caribbean, and Hong Kong	OpSec Compliance ISO27001 DPA
Netcraft Ltd	Brand Trust – Notice and Takedown Services	Brand protection services (including notice and takedown services)	Any Personal Data submitted as part of the Brand Trust – Notice and Takedown Services	Ireland and UK	Netcraft Compliance SOC2 TYPE 2 DPA/ SCC's
Google LLC	OnDMARC Brand Trust	Cloud services provider and data storage - OnDMARC Brand protection services (including notice and takedown services)	Any Personal Data Processed by Red Sift as part of those elements of the Services hosted by such Sub-Processor	EU (Belgium/ Netherlands)	Google Compliance ISO27001 ISO27701 SOC2 TYPE 2 DPA/ SCC's
Amazon Web Services, Inc.	Brand Trust – Notice and Takedown Services	Brand protection services (including notice and takedown services)	Any Personal Data submitted as part of the Brand Trust – Notice and Takedown Services	UK	AWS Compliance ISO27001 ISO27701 SOC2 TYPE 2 DPA/ SCC's

Aside from the Sub-Processors listed above, should a Customer require technical support, depending on the time of day, such support may be provided by an authorized employee from any of the Red Sift global entities for the provision of the Services:

Entity Name				Data Processing Region
Redsift Limited				UK
Redsift Inc.				USA
Redsift Spain S.L.				Spain
Redsift Germany GmbH				Germany
Hardenize Limited				UK

Where can you get information about our direct Processors?

Please note this page only lists details of the Sub-Processors that Red Sift appoints to perform Processing of Customer Personal Data which Red Sift carries out as customers’ Processor.

Accordingly, this page does not list any of Red Sift’s ‘direct’ Processors engaged to Process any Personal Data for Red Sift’s own business/customer relationship administration purposes, our own marketing, our own platform or service analytics, our own information and systems security purposes supporting the operation of the Services under the Agreement, nor our own legal, regulatory or compliance purposes.

You can find further details of the purposes for which we may use Personal Data as a Controller in our own right in our Privacy Notice.

Version: 23rd September 2026