‍
‍
Skip to main content
Generate your own deepfake for free

List of Sub-processors

The following Sub-processors are authorized by the Controller under the DPA. The Controller will be notified of any changes in accordance with Clause 5.2 of the DPA (30 days' prior notice).

Third Country Access' indicates that, while Personal Data is processed within the EU/EEA, the Sub-processor is affiliated with a parent entity incorporated in a third country (i.e., outside the EU/EEA). In such cases, applicable legislation of the third country (e.g., the U.S. CLOUD Act or FISA Section 702) may theoretically enable governmental authorities to compel the disclosure of data processed within the EU/EEA. Where Third Country Access is identified, appropriate transfer instruments (as specified per Sub-processor) are in place to mitigate this risk.

  1. STACKIT GmbH & Co. KG

Address: Stiftsbergstraße 1, 74172 Neckarsulm, Germany
Service: Hosting of all current and future components required for the provision of the Service, including API interface, database system, and mail server for phishing simulations. Hosting of the algorithm/model for generating the test attack playlist.
Data Processing Location: Germany / Austria
Third Country Access: No
Transfer Instrument: Not required (EU/EEA)

2. Amazon Web Services EMEA SARL

Address: 38 Avenue John F. Kennedy, L-1855, Luxemburg
Service: Orchestration of network delegation; hosting of the algorithm/model used to generate the test-attack playlist.
Data Processing Location: Germany
Third Country Access: Yes
Transfer Instrument: EU Standard Contractual Clauses (SCCs)

  1. Cloudflare, Inc.

Address: 101 Townsend St, San Francisco, CA 94107, USA
Service: Provision of bot detection services for revel8 websites.
Data Processing Location: Global (edge network, dependent on end-user location)
Third Country Access: yes (data processing location partially outside the EEA)
Transfer Instrument: EU Standard Contractual Clauses (SCCs); additionally the EU-U.S. Data Privacy Framework for U.S. access

  1. Celonis SE (use of make.com technology)

Address: Theresienstraße 6, 80333 Munich, Germany
Service: Provision of automation software for the execution of phishing simulations.
Data Processing Location: Germany
Third Country Access: No
Transfer Instrument: Not required (EU/EEA)

  1. Google Ireland Limited (optional: based on the services / features selected)

Address: Gordon House, Barrow Street, Dublin 4, Ireland
Service: Provision of email server infrastructure for customer communication via support software (support form or email to info@revel8.ai). This provider is only relevant if the Controller uses revel8 customer support.
Data Processing Location: EU
Third Country Access: Yes
Transfer Instrument: EU Standard Contractual Clauses (SCCs)

  1. wespond UG (haftungsbeschränkt) (Jamie) (optional: based on the services / features selected)

Address: Alte Kölner Straße 25a, 51503 Rösrath, Germany
Service: Automized processing and structuring of business communication content for internal documentation, customer success and follow-up purposes.
Data Processing Location: EU
Third Country Access: No
Transfer Instrument: Not required (EU/EEA)

  1. ElevenLabs Limited (optional: based on the services / features selected)

Address: 54 South Molton Street, Unit 201, London, England
Service: Generation of voice messages for AI-based test attacks. Voice messages are generated from selected individuals and sent to other employees as part of test attacks. This occurs only with the additional consent of the respective individuals from whom the digital voice clone is to be created.
Data Processing Location: EU
Third Country Access: Yes
Transfer Instrument: EU Standard Contractual Clauses (SCCs); Adequacy Decision for UK access

  1. Superpowered Labs Inc. (optional: based on the services / features selected)

Address: 95 Third Street, San Francisco, CA 94103, USA
Service: API orchestration of simulated, interactive vishing simulations.
Data Processing Location: USA, EU
Third Country Access: Yes (data processing location outside EEA)
Transfer Instrument: EU Standard Contractual Clauses (SCCs)

  1. OpenAI Ireland Ltd (optional: based on the services / features selected)

Address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland
Service: Generation of response texts in simulated, interactive vishing simulations.
‍Data Processing Location: US, EU
Third Country Access: Yes (data processing location outside EEA)
Transfer Instrument: EU Standard Contractual Clauses (SCCs)

  1. Mistral AI SAS (optional: based on the services / features selected)

Address: 15 rue des Halles, 75001 Paris, France
Service: Generation of response texts in simulated, interactive vishing simulations.
Data Processing Location: EU
Third Country Access: No
Transfer Instrument: Not required (EU/EEA)

  1. DeepL SE

Address: Maarweg 165, 50825 Cologne, Germany
Service: Translation of content into various languages.
‍Data Processing Location: EU
Third Country Access: No
Transfer Instrument: Not required (EU/EEA)

  1. Spryng B.V. (optional: based on the services / features selected)

Address: Prinsengracht 739–741, 1017 JX Amsterdam, The Netherlands
Service: Sending of SMS simulations.
Data Processing Location: EU
Third Country Access: No
Transfer Instrument: Not required (EU/EEA)

  1. Mailgun Technologies, Inc.

Address: 112 E. Pecan St. #1135, San Antonio, TX 78205, USA
Service: Sending of email simulations.
Data Processing Location: EU
Third Country Access: Yes
Transfer Instrument: EU Standard Contractual Clauses (SCCs); additionally EU-U.S. Data Privacy Framework for U.S. access

  1. Twilio Ireland Limited (optional: based on the services / features selected)

Address: 70 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland
Service: Execution of phone calls and sending of SMS simulations.
Data Processing Location: EU
Third Country Access: Yes
Transfer Instrument: EU Standard Contractual Clauses (SCCs)

  1. Datadog, Inc.

Address: 620 8th Avenue, 45th Floor, New York, NY 10018-1741, USA
Service: Monitoring and performance analysis of infrastructure, serverless workloads, databases, and applications. Additionally, Datadog processes data to provide logging services, Real User Monitoring (RUM), and session replay functionality.
Data Processing Location: EU
Third Country Access: Yes
Transfer Instrument: EU Standard Contractual Clauses (SCCs); additionally EU-U.S. Data Privacy Framework for U.S. access

To subscribe to notifications of changes to this list, please contact privacy@revel8.ai.

revel8 GmbH | Sandstr. 3 | 80335 Munich, Germany