1. Subprocessor Governance and Principles To deliver highly available, secure, and performant web services and software systems, Northwind Studio engages a limited group of verified third-party infrastructure and technology providers ("Subprocessors").#
Prior to onboarding any subprocessor, Northwind Studio conducts rigorous security and privacy due diligence, evaluating technical safeguards, data center compliance, encryption standards, and contractual commitments.
2. Infrastructure Subprocessors Directory The following third-party entities are authorized to process data in connection with our public website and digital operations:#
| Subprocessor | Processing Function | Processing Location | Data Safeguards |
|---|---|---|---|
| Vercel Inc. | Edge application hosting, serverless compute, global CDN delivery | United States & Global Edge Nodes | SOC 2 Type II, ISO 27001, TLS 1.3, EU SCCs |
| Google LLC (Google Cloud) | Google Analytics 4 telemetry (Consent Mode v2), enterprise workspace | United States & European Union | ISO 27001, SOC 2 / 3, Data Minimization, EU SCCs |
| GitHub Inc. (Microsoft) | Source code repository hosting, automated CI/CD security workflows | United States | SOC 2, ISO 27001, Branch Protections, MFA Enforcement |
| Resend / Amazon Web Services | Transactional notification delivery for inquiry intake forms | United States / European Union | SOC 2 Type II, TLS In Transit, EU SCCs |
3. Subprocessor Responsibilities and Guarantees All engaged subprocessors are bound by data processing agreements requiring them to:#
- Process data strictly according to our documented instructions.
- Implement robust technical and organizational security controls.
- Maintain strict confidentiality obligations across all personnel.
- Immediately notify Northwind Studio of any security incident affecting our systems.
4. Notification of Changes Northwind Studio maintains this public directory as our primary register of subprocessors. Enterprise clients with an executed Data Processing Addendum (DPA) receive advance notice of new subprocessor additions, with a minimum 30-day period to review and raise objections on reasonable data protection grounds.#
For inquiries or notices concerning subprocessors, contact contact@northwindstudio.tech.
Questions or Inquiries?
Direct inquiries regarding this policy are handled by our governance team.
If you require clarification on any term, wish to exercise a data subject right, or need custom contractual addenda, please contact:
Related Policies & Agreements
Privacy Policy
How Northwind Studio collects, processes, secures, and retains personal data across our digital platforms, client inquiries, and engineering operations in compliance with GDPR, UK Data Protection Act, and CCPA.
Data Processing Addendum (DPA)
Standard data processing terms governing customer personal data processing pursuant to GDPR Article 28, UK Data Protection Act, and global privacy frameworks.
Security & Vulnerability Disclosure
Our technical engineering safeguards, internal security posture, and responsible vulnerability disclosure process for independent researchers.