Legal

Subprocessors

The third-party companies we work with to run Cohesion Insight, what each one does, and where they’re located. We update this list when it changes.

Table of Contents

Subprocessors list

About this list

This page lists the third-party sub-processors that Cohesion Insight, Inc. ("Cohesion Insight," "we," "us," or "our") engages to help provide the Cohesion Insight Service. A sub-processor is a third party that processes Personal Data on Cohesion Insight's behalf under a written contract that includes data protection obligations. This list is maintained under Section 6 of the Cohesion Insight Data Processing Addendum and is referenced by the Privacy Policy, the Security Policy, and Annex III of the Standard Contractual Clauses. All sub-processors below are contractually bound to security and privacy commitments no less protective than those in the Cohesion Insight Data Processing Addendum, to the extent applicable to the services they provide. In this policy, “Cohesion Insight,” “we,” “us,” and “our” mean Cohesion Insight, Inc.

How we select sub-processors

Before we engage a sub-processor, we review the vendor for:

  • Security posture, including relevant certifications (SOC 2, ISO 27001, or equivalent).
  • Data protection posture, including a signed Data Processing Addendum and, for transfers outside the EU/UK/Switzerland, an appropriate transfer mechanism.
  • Fitness for the specific purpose the vendor is being engaged for.
  • Ability to meet Cohesion Insight's security and privacy commitments to customers.

We review our active sub-processors on a periodic basis and remove vendors that no longer meet these criteria.

How we notify customers of changes

Cohesion Insight provides at least thirty (30) days' prior notice of the addition or replacement of any sub-processor. Customers can subscribe to sub-processor change notifications by writing to privacy@cohesioninsight.ai with the subject line "Sub-processor updates."

Customers may object to a new sub-processor on reasonable data protection grounds within thirty (30) days of the notice, as described in Section 6 of the Cohesion Insight Data Processing Addendum.

Current subprocessors

The table below lists the subprocessors that Cohesion Insight currently engages, grouped by the category of service they provide.

Category: Cloud infrastructure and hosting

  • Amazon Web Services, Inc. — Cloud infrastructure, compute, storage, and managed services. Data processed: all categories of Customer Data. Location of processing: United States (primary), with regional failover as described in the Security Policy. Data protection mechanism: AWS Data Processing Addendum incorporating the Standard Contractual Clauses.

Category: Content infrastructure and in-app content

  • Sanity Inc. — Structured content platform used to store and deliver the content that renders in the Cohesion Insight product interface, on cohesioninsight.ai, and in customer-facing in-app notifications. Data processed: product and marketing content authored by Cohesion Insight, and the customer name and business email address of recipients where in-app notifications are personalized. Location of processing: United States. Data protection mechanism: Sanity Data Processing Addendum incorporating the Standard Contractual Clauses.

Category: Foundation models and AI infrastructure

  • OpenAI, L.L.C. — Foundation-model inference used to generate AI Outputs. Configuration: enterprise API tier with model-training disabled. Data processed: prompts and generated outputs, which may include Personal Data submitted through the Service. Location of processing: United States. Data protection mechanism: OpenAI Data Processing Addendum incorporating the Standard Contractual Clauses.
  • Anthropic, PBC — Foundation-model inference used to generate AI Outputs. Configuration: commercial API tier with model-training disabled. Data processed: prompts and generated outputs, which may include Personal Data submitted through the Service. Location of processing: United States. Data protection mechanism: Anthropic Commercial Terms of Service and Data Processing Addendum.

Category: Payment processing

  • Stripe, Inc. — Payment card processing, subscription billing, invoicing, and tax calculation. Data processed: billing name, billing address, payment card information, transaction records, tax information. Cohesion Insight does not store full payment card numbers. Location of processing: United States. Data protection mechanism: Stripe Data Processing Addendum incorporating the Standard Contractual Clauses.

Category: Customer communications and email

  • Sanity Inc. — Composition and rendering of transactional and lifecycle email content sent to customers, and rendering of in-app notification content. Data processed: recipient name, business email address, and message content for service and administrative communications. Location of processing: United States. Data protection mechanism: Sanity Data Processing Addendum incorporating the Standard Contractual Clauses.
  • Resend, Inc. — Transactional and lifecycle email delivery. Data processed: recipient name, business email address, and message content, for the purpose of delivering the emails composed in Sanity to customers and users. Location of processing: United States. Data protection mechanism: Resend Data Processing Addendum incorporating the Standard Contractual Clauses.

Corporate affiliates

Cohesion Insight is an independent Delaware corporation. It has no corporate parent, subsidiaries, or affiliates that process Customer Data.

Contact

Questions about this list or requests to subscribe to sub-processor change notifications: privacy@cohesioninsight.ai.

Cohesion Insight, Inc.

2810 N Church St, STE 89393

Wilmington, DE 19802-4447