This schedule describes the service providers and processing arrangements used by Disqnect. The agreed DPA identifies the arrangements authorised for each engagement. Supplier incorporation, hosting location and support access are distinct.
Parties and responsibilities
Your agreement for the Disqnect service is with Disqnect AS, organisation number 936 620 744, Olaf Helsets vei 5, 0694 Oslo, Norway. Disqnect remains your service provider when it uses the suppliers listed below.
For assessment personal data, the customer normally acts as controller and Disqnect as processor. Where a customer acts for its own clients, the DPA identifies the corresponding processor/subprocessor arrangement. Supplier roles depend on the service and data involved; corporate and development suppliers are listed separately from assessment processing.
Service providers and recipients
Application frontend and backend execution and the primary database are hosted in Frankfurt, Germany. Supporting services have additional processing locations, including the United States and Switzerland. The locations below distinguish application execution, storage, communications and other processing. They do not represent exclusively EU processing.
| Provider / service | Data and purpose | Processing locations and boundaries |
|---|---|---|
| Akenes SA (Exoscale), Switzerland - application hosting | Application frontend and server-side functions, assessment API, background processing and application logs | Application frontend and backend: Frankfurt, Germany. Provider administration may involve Switzerland. Provider telemetry and support processing are distinct from application hosting and selected-country data storage. |
| Neon / Databricks - database (entity as identified in the applicable account agreement) | Application accounts, findings, conversations, evidence and remediation history | Primary production database: Frankfurt, Germany. Configured recovery history: 7 days. Daily snapshots: 14-day expiry. These periods do not describe all provider-level residual copies. |
| TensorX Ltd., Ireland - AI inference | Assessment prompts and responses, including selected context and evidence | Inference is processed in Dublin, Ireland, and Helsinki, Finland. Inference content is processed transiently, without retention or use for model training. |
| Plus Five Five, Inc. (Resend) - authentication email | Recipient addresses, verification/reset links and portal access codes | Sending region: Ireland. Provider terms include US processing/storage. Email/log retention on the current plan: 30 days; backup and account-termination periods are separate. Tracking is disabled and TLS is enforced. |
| Proton AG, Switzerland - support email | Support contacts and correspondence; assessment reports and raw evidence are accessed through the platform | Published Mail storage locations: Switzerland, Germany and Norway; encrypted backups up to 30 days. Ancillary support processing is separate from mailbox storage. |
| Proton AG, Switzerland - incident records | Restricted incident templates and case-specific records where necessary | Published Drive storage locations: Switzerland, Germany and Norway; encrypted backups up to 30 days. Case-specific access and retention apply to incident evidence. |
| Com4 AS, Norway - SIM/private VPN | Device/SIM identifiers, connectivity metadata and traffic transport | Private cellular/VPN connectivity. This schedule does not establish fixed countries for network termination, roaming or administrative access; country restrictions require agreement for the connectivity service. |
| Shodan - standard API lookup | Occasional target-IP queries and associated API-account/request metadata | Target-IP lookups through the standard API. Assessment reports and conversations are not submitted in this flow. Query-associated metadata is logged by the provider. No fixed processing-country or query-retention commitment is established in this schedule. Customer-specific restrictions must be resolved before enabling the lookup for that engagement. |
Germany
Switzerland
Ireland
Finland
US
NorwayOptional development and evaluation - separate opt-in
Use of identifiable or confidential customer assessment content to improve or evaluate Disqnect requires the customer's separate, recorded opt-in before processing. This is not included in standard assessment processing or authorised merely by accepting the standard DPA. The separate agreement identifies the purpose, permitted data, provider and product, processing locations, retention and withdrawal arrangements. A provider's no-training setting does not replace that authorisation.
| Service | Purpose and scope |
|---|---|
| OpenAI Codex Business | Development and evaluation assistance using customer-authorised excerpts, only under the separate opt-in agreement. The agreement must identify the applicable Business workspace and provider arrangements. |
| Anthropic | Not the current development provider. Any future use of customer content requires separate opt-in and confirmation of the applicable product, terms and processing arrangements before use. |
Other infrastructure and website services
These services are listed for context. Their inclusion does not automatically make them subprocessors of assessment content; their role depends on the data actually processed.
| Service | Purpose and scope |
|---|---|
| Cloudflare R2 | Distribution of signed software updates and associated request/device metadata. Customer assessment artifacts are stored in Neon, not R2. |
| GitHub | Source hosting and development infrastructure. It is not a designated destination for customer assessment evidence. |
| Netlify | DNS management and public marketing website hosting. It does not host the assessment application or receive its assessment data or application logs. Marketing-site visitor metadata, enquiries and applicable processing locations are covered by the website privacy notice. |
| PRO ISP | Domain registration and renewal. |
Customer authorisation and changes
The signed DPA and completed customer schedule govern initial subprocessor authorisation, permitted locations and transfer safeguards. This information page does not itself grant customer authorisation. Customer-specific restrictions form part of the agreed processing instructions.
The DPA sets out written notice and objection arrangements for new or replacement subprocessors. Updating this page alone does not replace contractual notification. International transfers are subject to the applicable agreed safeguards.
Privacy and supplier enquiries: privacy@disqnect.com.
Provider legal information
The following are the providers' own published terms and privacy information. The applicable account agreement and completed customer schedule determine the contractual arrangements.
- Akenes SA (Exoscale): Data Processing Addendum and Terms and Conditions.
- Neon / Databricks: Neon product terms. The published schedule names Databricks, Inc., parent of Neon, LLC; the account-applicable agreement determines the entity for this service.
- TensorX Ltd., Ireland: Data Processing Agreement.
- Netlify, Inc.: Data Processing Agreement.
- Plus Five Five, Inc., trading as Resend: Data Processing Addendum.
- Proton AG: Data Processing Agreement.
- Com4 AS: Privacy statement.
Questions about Disqnect's agreements or the suppliers relevant to your engagement: privacy@disqnect.com.