Sub-processors
This page lists the sub-processors that process personal data for Securapilot on behalf of VER&IT AB, where they are located and when they are used. It belongs with the data processing agreement.
Last updated: 2026-11-10
Always used
The service does not work without these providers. They are used for all customers.
| Sub-processor | Purpose | Data | Location | When used |
|---|---|---|---|---|
| Elastx | Servers for the application, databases and logs (OpenStack) | All data in the service | Sweden | Always |
| Oderland Webbhotell AB | Object storage (S3) for uploaded files and database backups | Uploaded files and database backups | Sweden | Always |
| Hetzner Online GmbH | Server where VER&IT runs a mail relay for outgoing e-mail | Recipient e-mail addresses and names, and the content of notification messages | Germany (EU) | Always |
| Aikido Security BV | Application firewall (Zen) that detects and logs attacks | Attack events, request metadata and client IP addresses | The company (Aikido Security BV) is seated in Belgium. Processing location is not stated here | Always |
Used only if the customer enables the feature
The provider is called only once the customer's administrator turns the feature on. AI assistance is off by default for all customers.
| Sub-processor | Purpose | Data | Location | When used |
|---|---|---|---|---|
| OpenAI | AI assistance | The content the user sends to the AI feature | USA | Only if the customer turns on AI assistance and chooses OpenAI |
| Berget AI AB | AI assistance | The content the user sends to the AI feature | Sweden | Only if the customer turns on AI assistance and chooses Berget AI |
| Anthropic | AI assistance | The content the user sends to the AI feature | USA | Only if the customer turns on AI assistance and Anthropic has been configured |
| ip-api.com | Country lookup of the login IP for login country restriction | The IP address of the user logging in | Not stated by the provider | Only if the customer enables login country restriction |
Customer-directed integrations
The customer connects these itself. Data is sent where the customer points, using the customer's own credentials. They are not sub-processors of VER&IT.
| Integration | Purpose | Data sent | Where data goes |
|---|---|---|---|
| Microsoft Entra ID / Microsoft Graph | User synchronisation and sign-in | User profiles as permitted by the customer | The customer's Microsoft tenant |
| Microsoft Sentinel | Streaming the customer's audit log to the customer's SIEM | Audit log entries | The customer's Sentinel workspace |
| Microsoft Teams (webhook) | Notifications to a channel the customer chooses | Notification text | The customer's Teams tenant |
| SSO / OpenID Connect | The customer's sign-in | Data as defined by the protocol | The customer's identity provider |
| Webhooks and SIEM streaming | The customer's own recipients | Audit log and scan results | Recipients the customer specifies |
| Own OpenAI-compatible endpoint or SecuraConnect | AI assistance on the customer's own equipment | The content the user sends to the AI feature | The customer's own server or computer |
Transfers to third countries
Processing in Sweden and Germany takes place within the EU/EEA. Providers in the USA are used only if the customer itself turns on AI assistance and chooses such a provider. The transfer then relies on the provider's EU-US Data Privacy Framework certification or on standard contractual clauses.
Changes
New or replaced sub-processors are notified to customers in accordance with section 10 of the data processing agreement. Data processing agreement.
Questions
Send questions about sub-processors to dpo@securapilot.com.