Sub-processors

The people you train trust you with their data. Here is every company that helps us process it on your behalf, and what each of them can see.

Sub-processors for trainee data

Status as of 1 October 2026. This list matches Annex 3 to the data processing agreement.

Microsoft Ireland Operations Ltd (Microsoft Azure)

Hosting, database, certificate file storage, backups and technical logs

What they can see: Trainee data your organization enters, training results, certificates and technical logs
Where the data is: EU: West Europe (Netherlands), backup storage in North Europe (Ireland), technical logs in Germany West Central
Safeguards: The data stays in the EU
Certifications: ISO 27001, SOC 2 Type II

Cloudflare, Inc.

Reverse proxy, CDN, DDoS protection and DNS

What they can see: Cloudflare terminates the encrypted connection, so it handles request content in transit, but does not store it
Where the data is: USA
Safeguards: EU-U.S. Data Privacy Framework and Standard Contractual Clauses
Certifications: ISO 27001, SOC 2 Type II

Twilio Inc. (SendGrid)

System e-mails (such as account activation and password reset) and training reminders that the administrator sends to trainees from the panel

What they can see: E-mail address and message content. For a training reminder: the trainee's first name, last name and e-mail, the organization name, the training name, the due date and whether it has passed. Certificates are not sent by e-mail.
Where the data is: USA
Safeguards: EU-U.S. Data Privacy Framework and Standard Contractual Clauses
Certifications: ISO 27001, SOC 2 Type II

Meta Platforms Ireland Ltd (Wit.ai)

Speech recognition for voice commands in the EHS Academy app — only in the BLS-AED In The Factory test lesson (calling for help, asking for the AED or first-aid kit; 7 languages).

What they can see: All other lessons only measure loudness on the headset and send no audio. Recording of the trainee's voice while speaking a command, its transcription and the headset's IP address. No trainee name or code. Wit.ai keeps recordings for no longer than 90 days. Under the Wit.ai terms (wit.ai/terms), Meta may use the submitted content to improve its services, including speech recognition.
Where the data is: USA (processed by Meta Platforms, Inc.)
Safeguards: Standard Contractual Clauses (Meta Global Processor Terms)

The AI services we use to translate and dub courses, create voice-overs and generate course covers — OpenRouter (models by Anthropic and Google) and ElevenLabs — receive course content only, including the names and descriptions of custom courses your administrators enter. They never receive trainee records.

On our website and during sign-in we also use Google (reCAPTCHA, and Google Analytics with consent) and LinkedIn (with marketing consent). They concern visitors and panel users, not trainee data, so they are not sub-processors. The Privacy Policy and the Cookie Policy describe them.

How the data is protected

Encryption in transit

Connections to the platform are encrypted with HTTPS (TLS).

Agreements with sub-processors

Each sub-processor is bound by contract to data protection obligations equivalent to those in our agreement with your organization. We remain fully responsible for their work. Where a sub-processor's terms differ, its entry above says how.

Changes to the list

Before we add or replace a sub-processor, we tell the organizations that accepted the data processing agreement, so they can object on reasonable data protection grounds.

Questions about sub-processors?

Write to us and we will explain how your trainees' data is processed.

[email protected]