Vendor and Subprocessor Management Policy

1. Purpose

To describe how we choose, review, and list the third parties that store or process data on our behalf.

2. Definitions

A subprocessor stores or processes participant or client data as part of delivering our products. A vendor is any other supplier (for example, an accounting tool or a design service) that does not touch participant data. This policy is mainly about subprocessors; vendors are covered by section 6.

3. Selection

Before a new subprocessor receives any participant data, the Director confirms:

1. It holds a current SOC 2 Type II report or ISO 27001 certification, published or available on request
2. Its terms prohibit using our data to train models or for its own purposes beyond providing the service
3. Where it stores data, and whether that location is acceptable for our clients (preference: Australia or New Zealand; otherwise a jurisdiction with recognized data protection law)
4. It offers a data processing agreement or equivalent contractual terms
5. Its retention and deletion behavior is documented
6. Its security contact and status page are known

The findings are recorded in the Subprocessors table on the Trust Center with the date of review.

4. Minimizing what subprocessors see

The best subprocessor control is sending less. For each subprocessor we record exactly which fields it receives and remove any that are not needed for the service. The AI provider, for example, receives assessment scores and labels but not names or email addresses.

5. Current subprocessors

The authoritative list is at flame.live/trust/subprocessors (and the equivalent page on values.institute). At this version it comprises Vercel, Supabase, GitHub, Anthropic, and Twilio SendGrid (the sign-in email).

6. Vendors that don't touch participant data

Accounting (Xero), communication (Google Workspace), and design or productivity tools are selected on ordinary commercial grounds. They receive client business contact details and financial records in the normal course of business, under their own privacy terms, and are not listed as subprocessors.

7. Ongoing review

• Each subprocessor's compliance status and terms are re-checked annually, and the review date updated on the Subprocessors page.
• Subprocessor security notices and status pages are checked during any incident investigation.
• If a subprocessor's terms change in a way that affects our data (for example, a change to training or retention policy), we reassess within 30 days and migrate if needed.

8. Changes and client notice

• The Subprocessors page carries a dated change log.
• Clients who have asked to be notified of subprocessor changes receive an email at least 30 days before a new subprocessor receives participant data, with the opportunity to object.
• A subprocessor is removed from the list only after our data has been deleted from it, or the deletion has been requested and confirmed in writing.

9. Fourth parties

Our subprocessors use their own infrastructure providers (principally Amazon Web Services). We rely on each subprocessor's published compliance documentation to cover its own suppliers and do not separately assess them.

10. Review

Reviewed annually and whenever a subprocessor is added or removed.

11. Version history