Sub-processor List
Last updated: 14 October 2026
This list identifies the sub-processors Spectrum Security, Inc. engages in delivering its service: the third parties that may process customer data on our behalf. It is maintained under Section 6 of the Spectrum Data Processing Addendum.
Scope. This list covers Spectrum's processor-side processing — data handled on behalf of business customers in delivering the service. The third-party providers on Spectrum's public website are a separate, controller-side matter and are described in our Privacy Notice and Cookie and Tracking Policy, not here. Internal tools that do not access customer data are not sub-processors and are not listed.
All data processing agreements below were reviewed on 29 September 2026.
Sub-processors
OpenAI (OpenAI OpCo, LLC; OpenAI Ireland Ltd for EEA/Swiss)
- Purpose
- AI inference for detection-rule analysis
- Data processed
- Rule content and log data submitted for analysis (may include personal data / incidental special-category data)
- Location
- United States (EEA/Swiss data routed via OpenAI Ireland)
- Transfer safeguard
- EU SCCs + UK Addendum, under OpenAI's DPA
Anthropic (Anthropic, PBC; Anthropic Ireland for EEA)
- Purpose
- AI inference for detection-rule analysis
- Data processed
- Rule content and log data submitted for analysis (may include personal data / incidental special-category data)
- Location
- United States
- Transfer safeguard
- EU SCCs + UK and Swiss addenda, under Anthropic's DPA
Langfuse (Langfuse Cloud, operated by ClickHouse, Inc.)
- Purpose
- LLM observability / tracing for debugging
- Data processed
- Trace data (may include rule/log content submitted for analysis), retained for 30 days
- Location
- United States
- Transfer safeguard
- EU SCCs + UK Addendum, under the ClickHouse DPA
Amazon Web Services (AWS)
- Purpose
- Hosting the service environment
- Data processed
- Transient log data; debug telemetry (retained up to 30 days); encrypted customer SIEM integration credentials
- Location
- United States
- Transfer safeguard
- EU SCCs + UK IDTA + Swiss addendum, under the AWS DPA
Elastic Cloud (Elasticsearch B.V. / Elastic N.V.)
- Purpose
- Security monitoring of Spectrum's own systems
- Data processed
- Spectrum's own operational and security logs only; does not receive customer event data or data submitted for analysis
- Location
- United States
- Transfer safeguard
- EU SCCs + EU-U.S. Data Privacy Framework, under Elastic's DPA
PostHog (PostHog, Inc.)
- Purpose
- Feature flags, frontend debugging, and customer-issue troubleshooting within the Spectrum app
- Data processed
- App usage events and account-user identifiers; session replay uses PostHog's strictest "Total Privacy Masking", so on-screen text and inputs are masked and customer content displayed in the app is not captured
- Location
- United States
- Transfer safeguard
- EU SCCs + UK IDTA + Swiss addendum, under PostHog's DPA
Elastic Cloud does not receive customer content. It is listed because Spectrum's own logs can contain account-user identifiers.
Customer-controlled alternative: where a customer supplies its own AI provider keys or uses a customer-controlled inference proxy, the relevant AI provider operates under that customer's own arrangements for that path, rather than as Spectrum's sub-processor.
Notes
- Updates: Spectrum notifies customers of new sub-processors in accordance with Section 6 of the DPA (general authorisation with an objection period) before they process customer data.
- Provider sub-processor lists: OpenAI (platform.openai.com/subprocessors) and Anthropic (anthropic.com/subprocessors) maintain their own sub-processor lists.
Questions and requests
Customers. Questions about this list, or objections under Section 6 of the Data Processing Addendum, go to legal@spectrum.security.
Individuals. If your data was processed through an organisation that uses Spectrum, make your request to that organisation, which is the controller of that data. We will assist them in responding. For personal data we hold as a controller, see Section 8 of the Privacy Notice.