Cotterpin Technologies Ltd · Sub-processors · Version 1.0 · https://cotterpin.io/legal/subprocessors.html
Legal
Sub-processors
The companies that process personal data for us, what each one receives, and where.
- These are the companies that process personal data for Cotterpin, what each one does, what it receives and where.
- None of them receives your source code: Cotterpin never has it to pass on.
- We will update this page, and tell Team and Enterprise customers, before we add or replace one.
1. Current sub-processors and service providers
| Provider | Purpose | Personal data | Location | Role |
|---|---|---|---|---|
| Amazon Web Services EMEA SARL / Amazon Web Services, Inc. | The licence service: computing (Lambda), database (DynamoDB), signing keys (KMS), secrets (Secrets Manager) | Licence id, plan, machine fingerprints (keyed hashes), machine list and audit records, Cotterpin version, request IP addresses, hashed email addresses | EU (Ireland), eu-west-1 | Processor |
| Amazon Simple Email Service (AWS) | Sending one-time claim codes from licences@cotterpin.io | The email address you claim with, and the code | EU (Ireland), eu-west-1 | Processor |
| Paddle.com Market Ltd | Merchant of record and reseller: checkout, payment, tax, invoices, refunds, customer portal | Name, email, billing address and country, payment details, tax information, order history | UK, with its own processors, listed in Paddle's privacy policy | Independent controller |
| Google Ireland Limited (Google Analytics 4) | Counting website visits and pages viewed — only for visitors who accept analytics cookies | A random browser identifier (the _ga cookies), pages viewed, approximate location and device type; no IP address is stored | EU, with transfers to Google LLC in the United States under the EU–US Data Privacy Framework and its UK Extension | Processor |
| Microsoft Corporation (Azure Static Web Apps) | Hosting this website | IP address and request details of website visitors | Microsoft's global network (the site is served from the location nearest the visitor); transfers to the United States under the EU–US Data Privacy Framework and its UK Extension, and Microsoft's Standard Contractual Clauses | Processor |
| Microsoft (Microsoft 365) | Receiving and sending our email (support, security, privacy) | Names, email addresses and message contents | Microsoft's datacentres for our tenant's region; any transfer to the United States is covered by the EU–US Data Privacy Framework and its UK Extension, and Microsoft's Standard Contractual Clauses | Processor |
Not sub-processors: your model providers (Anthropic for Claude, OpenAI for Codex, xAI for Grok). When your agent or a Cotterpin task calls one, it does so under your own account, directly from your machine, under that provider's terms with you. Nothing passes through us.
The website's fonts are served from the website itself, so no font service receives visitors' details.
2. Planned changes
Team single sign-on (Okta, Microsoft Entra ID, Google Workspace and GitHub) uses the identity provider your organisation already has: that provider is yours, not our sub-processor. What the licence service stores for it is held with Amazon Web Services, listed above. No other change is planned; if one is, we will add it here, and tell customers as described below, before it starts.
3. How we tell you about changes
- We update this page before a new sub-processor starts processing personal data, and change the “last updated” date above.
- Team and Enterprise customers who have accepted our Data Processing Addendum are told by email at least 30 days in advance and may object, as the DPA sets out.
- Anyone else can ask to be told about changes: email privacy@cotterpin.io asking to be added to the sub-processor notice list.
4. Safeguards
Each processor is bound by a contract with data protection terms at least as protective as our own commitments. Transfers outside the UK and EU rely on the safeguards in our Privacy Policy.