A subprocessor is a third-party service provider that processes personal data on behalf of Xygeni in connection with the provision of the Xygeni Platform. As a data processor under GDPR, Xygeni is responsible for ensuring that all subprocessors provide sufficient guarantees regarding the technical and organisational measures they apply, and that they process personal data only on Xygeni’s documented instructions.
This list covers subprocessors that may access or process personal data submitted by customers to the Xygeni Platform, or personal data of customer representatives held by Xygeni in connection with our commercial relationship. It does not include tools used exclusively for Xygeni’s internal operations that have no access to customer data.
Xygeni applies the following criteria to determine whether a provider qualifies as a subprocessor for the purposes of this list:
The following subprocessors are currently engaged by Xygeni. For details on the data processed by each subprocessor and the applicable transfer mechanisms, see the Data Processing Agreement at https://xygeni.io/legal/dpa.
These subprocessors provide the core cloud infrastructure on which the Xygeni Platform runs.
| Subprocessor | Location | Purpose |
|---|---|---|
| Amazon Web Services (AWS) | Ireland, EU (eu-west-1) | Cloud infrastructure, hosting, storage and compute for the Xygeni Platform |
These subprocessors provide services that support the delivery, sales and operation of the Xygeni Platform.
| Subprocessor | Location | Purpose |
|---|---|---|
| OpenAI, L.L.C.* | United States | AI-powered code remediation and analysis features. See note below. |
| HubSpot, Inc. | United States | Customer relationship management (CRM), sales pipeline and marketing communications |
| Google LLC (Google Workspace) | United States / EEA | Internal collaboration, email, document and spreadsheet storage used in account management and support |
* Note on OpenAI: This subprocessor applies only where the customer uses Xygeni’s integrated AI features (code remediation and analysis). Where a customer has integrated their own AI model, all AI processing occurs entirely within the customer’s own infrastructure and OpenAI is not involved. The data processed by OpenAI is limited to specific code segments and does not include personal data — Xygeni has confirmed that standard source code does not constitute personal data under GDPR. Xygeni does not use customer code to train AI models.
Xygeni will provide customers with at least ten (10) days’ prior written notice before engaging a new subprocessor or materially changing the role of an existing one. Notification will be provided by updating this page (with the “Last updated” date revised accordingly) and by email notice to the customer’s designated contact.
Customers who have executed a Data Processing Agreement (DPA) with Xygeni may object to new subprocessors on reasonable data protection grounds within five (5) days of such notification, in accordance with the terms of the DPA.
For each subprocessor listed above, Xygeni has:
Xygeni remains fully liable to its customers for the performance of each subprocessor’s obligations to the extent that the subprocessor fails to fulfil its data protection duties.
For questions about this list or Xygeni’s use of subprocessors, contact us at privacy@xygeni.io.
To subscribe to notifications of changes to this list, send your email address with subject “Subprocessors notification” to privacy@xygeni.io.