Legal
Sub-processor List
Third-party entities that process End-User Data on behalf of Webb Applications when you use RectifAI.
Sub-processor List
Effective date: 19 April 2026
Last updated: 19 April 2026
Webb Applications ("we") uses the following third-party sub-processors to deliver RectifAI. Each sub-processor has been evaluated for data protection compliance, and transfers outside the EEA are governed by Standard Contractual Clauses or equivalent approved mechanisms.
We will provide at least 30 days' notice before adding or making material changes to a sub-processor by updating this page and notifying workspace administrators.
Infrastructure and hosting
| Sub-processor | Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Google Cloud Platform | Google LLC | Cloud hosting (Cloud Run), database (Cloud SQL / PostgreSQL), object storage (GCS), message queuing (Pub/Sub), secret management | All End-User Data stored in the Service | UK (europe-west2) | Adequacy decision (UK GDPR) |
AI and automation
| Sub-processor | Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| OpenAI | OpenAI, LLC | AI-assisted post-incident analysis and report generation | Incident title, description, status, duration, affected systems, team names, member names, member email addresses, incident timeline, task details, role assignments | United States | Standard Contractual Clauses (SCCs) |
Note: Incident data including member names and email addresses is sent to OpenAI when generating post-incident reports. OpenAI's API data is not used for model training under their zero data retention / enterprise API terms. Review OpenAI's privacy policy for full details.
Monitoring and observability
| Sub-processor | Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Sentry | Functional Software, Inc. | Error monitoring, performance tracing, session replay | Error messages, stack traces, application logs, session replays (text masked; media blocked) | Germany (EU) | Adequacy decision / intra-EU transfer |
Sentry is hosted at
de.sentry.io(German data centre). Text masking is enabled; media is blocked. Approximately 10–20% of transactions are sampled and 1% of sessions are replayed in production.
Communication
| Sub-processor | Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Resend | Resend, Inc. | Transactional email delivery (workspace invitations) | Recipient email address, first name, last name, workspace name, inviter display name | United States | Standard Contractual Clauses (SCCs) |
Incident management integrations
These sub-processors are engaged when customers choose to connect the relevant integration. Data is only shared with a sub-processor after the customer explicitly enables the connection.
| Sub-processor | Entity | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|---|
| Atlassian (Jira Service Management) | Atlassian Pty Ltd | Bidirectional incident ↔ JSM ticket sync | Incident title, description, status, severity, Jira issue keys and field values | Australia / United States | Standard Contractual Clauses (SCCs) |
| Slack | Slack Technologies, LLC | Incident notifications, channel creation, status updates | Incident title, description, status, severity, actor names, event messages | United States | Standard Contractual Clauses (SCCs) |
| PagerDuty | PagerDuty, Inc. | Paging alerts and escalation sync | Incident title, status, severity, responder details | United States | Standard Contractual Clauses (SCCs) |
| Microsoft (Teams / Azure AD) | Microsoft Corporation | Teams channel notifications and status sync | Incident title, description, status, actor names | United States / EU | Standard Contractual Clauses (SCCs) |
| Zoom | Zoom Video Communications, Inc. | Meeting creation and participant data | Meeting participant metadata, incident linkage | United States | Standard Contractual Clauses (SCCs) |
| Google Chat | Google LLC | Incident notifications in Google Chat spaces | Incident title, description, status | United States | Standard Contractual Clauses (SCCs) |
Changes to this list
To be notified of sub-processor changes, contact privacy@webbapplications.co.uk and request to be added to our sub-processor notification list.
For the full privacy context, see our Privacy Policy.