Subprocessors

1. What Is a Subprocessor

A subprocessor is a third-party service provider that processes personal data on behalf of Xygeni in connection with the provision of the Xygeni Platform. As a data processor under GDPR, Xygeni is responsible for ensuring that all subprocessors provide sufficient guarantees regarding the technical and organisational measures they apply, and that they process personal data only on Xygeni’s documented instructions.

This list covers subprocessors that may access or process personal data submitted by customers to the Xygeni Platform, or personal data of customer representatives held by Xygeni in connection with our commercial relationship. It does not include tools used exclusively for Xygeni’s internal operations that have no access to customer data.

2. Scope and Criteria

Xygeni applies the following criteria to determine whether a provider qualifies as a subprocessor for the purposes of this list:

• The provider has access to personal data that customers submit to the Platform, or to personal data of customer representatives held by Xygeni in connection with providing or supporting the service.
• Access to such data is incidental to, and necessary for, the provision of the Platform or related services.
  The provider is not acting as an independent data controller for their own purposes.
• Providers that operate solely as independent controllers for their own data (such as payment card networks, public analytics platforms used without customer data, or standard cloud communication services that process only technical metadata) are not included in this list.

3. Current Subprocessors

The following subprocessors are currently engaged by Xygeni. For details on the data processed by each subprocessor and the applicable transfer mechanisms, see the Data Processing Agreement at https://xygeni.io/legal/dpa.

3.1 Infrastructure Subprocessors

These subprocessors provide the core cloud infrastructure on which the Xygeni Platform runs.

3.2 Other Subprocessors

These subprocessors provide services that support the delivery, sales and operation of the Xygeni Platform.

* Note on OpenAI: This subprocessor applies only where the customer uses Xygeni’s integrated AI features (code remediation and analysis). Where a customer has integrated their own AI model, all AI processing occurs entirely within the customer’s own infrastructure and OpenAI is not involved. The data processed by OpenAI is limited to specific code segments and does not include personal data — Xygeni has confirmed that standard source code does not constitute personal data under GDPR. Xygeni does not use customer code to train AI models.

4. Notification of Changes

Xygeni will provide customers with at least ten (10) days’ prior written notice before engaging a new subprocessor or materially changing the role of an existing one. Notification will be provided by updating this page (with the “Last updated” date revised accordingly) and by email notice to the customer’s designated contact.

Customers who have executed a Data Processing Agreement (DPA) with Xygeni may object to new subprocessors on reasonable data protection grounds within five (5) days of such notification, in accordance with the terms of the DPA.

5. Safeguards and Contractual Protections

For each subprocessor listed above, Xygeni has:

• Conducted due diligence on the subprocessor’s security practices and data protection compliance.
• Entered into a data processing agreement imposing data protection obligations no less protective than those in Xygeni’s DPA with its customers.
  Implemented the applicable transfer mechanism (Standard Contractual Clauses) for subprocessors located outside the European Economic Area.
• Required each subprocessor to notify Xygeni within 24 hours of becoming aware of any personal data breach affecting data processed on Xygeni’s behalf, enabling Xygeni to meet its 48-hour notification obligation to customers.

Xygeni remains fully liable to its customers for the performance of each subprocessor’s obligations to the extent that the subprocessor fails to fulfil its data protection duties.

6. Contact

For questions about this list or Xygeni’s use of subprocessors, contact us at privacy@xygeni.io.

To subscribe to notifications of changes to this list, send your email address with subject “Subprocessors notification” to privacy@xygeni.io.