Sub-processors
Last updated: 1 October 2026
Skiwo AS engages the following sub-processors to provide Report Securely, on the terms in section 5 of our Data Processing Agreement. The Controller authorises these sub-processors, and we inform Controllers before adding or replacing one.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Heroku (Salesforce, Inc.) | Application hosting, database and job queue | All data in the Service | EU: database in Frankfurt, Germany; application servers in Dublin, Ireland |
| Amazon Web Services EMEA SARL | Storage of attachments and backups, and delivery of email | Attachments, database backups, and the recipients and content of emails the Service sends | EU: Frankfurt, Germany |
| Heroku Managed Inference (Salesforce, Inc.) | Optional tool that rephrases a reporter's text to remove identifying writing style, using an Anthropic Claude model. It runs only when the reporter chooses it | The text the reporter asks to have rephrased | EU: Heroku's EU region |
| Sveve AS | SMS for two-factor login codes | Phone numbers of case handlers and other users who log in | Norway |
Where the data is
All data in the Service, including its backups, is stored and processed in the EEA. Heroku and Amazon Web Services belong to groups headquartered in the United States. Any access from outside the EEA is covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
The reporting pages load nothing from third parties: fonts and every other file are served from our own servers.
Services we use as controller
Two services receive no whistleblowing data and process data for our own purposes, as described in our Privacy Policy:
- Stripe, for billing customers (Ireland, with transfers to the United States).
- Google Maps Places, for address suggestions when a customer's administrator enters the organisation's address (United States).
Contact
Questions about our sub-processors: privacy@reportsecurely.com