The DPA applies to every customer and forms part of the terms. The sub-processor list below is current as of [date]; changes are notified [notice period] in advance to account administrators.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| [Cloud infrastructure provider] | Hosting, storage, backups, key management | All customer content and account data | [Region(s)] |
| [Transactional email provider] | Sign-in links, notifications, reminders | Names, email addresses, notification content | [Region] |
| [AI model provider] | Magpie AI drafting and suggestions | Prompts and the document content submitted to the co-pilot | [Region] |
| [Support and ticketing tool] | Customer support | Names, email addresses, support correspondence | [Region] |
| [Product analytics tool] | Aggregated usage analytics | Pseudonymous usage events | [Region] |
| [Error monitoring tool] | Reliability monitoring | Technical error data, which may include identifiers | [Region] |
The Customer is the controller of content it places in Blueprint+; Gieom is the processor and acts only on the Customer's documented instructions.
The technical and organisational measures described on the Trust & Security page, annexed to the DPA.
General authorisation with advance notice of changes and a right to object. Sub-processors are bound by equivalent obligations.
Transfers outside the hosting region are covered by [mechanism], with the applicable clauses annexed.
Support for data subject requests, impact assessments and breach notification within [period]; audit rights with reasonable notice, or reliance on the SOC 2 report.
Export at any time; deletion within [period] of termination with written confirmation.