1. Sub-processors of customer data
These organisations process personal data that we process on our customers’ behalf (customer endpoint data and console data). They are engaged under the general written authorisation in clause 7 of our Data Processing Agreement, and we give at least 30 days’ notice before adding or replacing one.
| Sub-processor | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| [TO CONFIRM: email relay provider] | Delivery of platform emails: account emails, and alert notifications for tenants that use the platform relay rather than their own | Recipient email addresses; alert content, which may include device names, usernames and event details | [TO CONFIRM: location] | [TO CONFIRM: transfer safeguard, if outside the UK] |
Not sub-processors, because Denwen does them itself. The service runs on a server Denwen owns and operates at its own premises in the United Kingdom; there is no hosting or cloud provider. The optional Denwen AI assistant uses a model running on Denwen’s own hardware, so prompts are not sent to any AI company. Backups are copied to a separate Denwen-owned machine in the United Kingdom; no storage provider is involved.
2. Service providers for our own data
These providers process personal data for which Denwen is the controller — for example, our own billing records. They are described in our Privacy Policy and are not sub-processors of customer data.
| Provider | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| Stripe (Stripe Payments Europe Ltd / Stripe Payments UK Ltd) | Subscription billing, checkout and payment processing | Billing contact name, email and address; subscription and payment records. Card details are entered directly with Stripe and never reach Denwen | UK / EEA, with onward transfers by Stripe [TO CONFIRM: confirm Stripe entity and locations] | [TO CONFIRM: Stripe’s data processing terms and transfer mechanism] |
We also obtain TLS certificates from Let’s Encrypt. This involves only our own domain names; no customer or personal data is sent to it, so it is not a sub-processor.
3. Services you choose are not our sub-processors
Denwen RMM can send data to services that you choose and configure. Because you choose them and hold the relationship with them, they are your processors (or independent controllers), not ours:
- your own SMTP relay, when a tenant sends its alerts through it;
- webhooks you configure, and the services behind them;
- your professional services automation (PSA) system — for example HaloPSA, ConnectWise or Autotask;
- your single sign-on identity provider — for example Microsoft Entra ID; and
- your own AI model provider, if you bring your own model rather than using Denwen AI.
4. Changes and objections
We update this page before a new sub-processor starts processing customer data, and email the account owner of each customer at least 30 days in advance. To object, write to hello@denwen.co.uk within that period; the process is set out in clause 7.3 of the DPA. Managed service providers may pass these notices on to their own clients.