Subprocessors

Current Subprocessors

The following third parties may process personal data on our behalf to help deliver our services:

Data Transfer Mechanisms

For international data transfers, we rely on the following legal mechanisms:

• Standard Contractual Clauses (SCCs): EU-approved data transfer clauses
• EU-US Data Privacy Framework: For certified US companies
• Binding Corporate Rules: Where applicable

Subprocessor Due Diligence

Before engaging any subprocessor, we conduct thorough security and privacy assessments:

• Security certification verification (SOC 2, ISO 27001, etc.)
• Data processing agreement review and execution
• Privacy impact assessment where applicable
• Regular ongoing monitoring and annual reviews

Notification Process

We notify customers of subprocessor changes through the following process:

1. 1Update published to this page
2. 2Email notification to subscribed customers
3. 330-day notice period before new subprocessor engagement
4. 4Objection handling process (Enterprise DPA customers)

Subscribe to Updates

To receive notifications about subprocessor changes, email privacy@zof.ai with subject "Subscribe to Subprocessor Updates" and include your organization name.

Questions

For questions about our subprocessors or data processing practices, contact our Data Protection Team at dpo@zof.ai.