Layer 2 · Compare
The Public Grid
One row per assessed offering, one column per observation, across the whole population. A buyer looks up a supplier and reads what that supplier has published, in the same columns as everybody else. It is free, and it stays free.
Document Class: Segment Report
- Assessed
- 111 organisations, 147 offerings
- Evidence Cutoff
- 2026-07-29 to 2026-08-15 — per row, never one date for the register
- Method Generations
- v1.6 × 130 · v1.4 × 12 · v1.1 × 5
- Standards Commits
- 38 distinct, one recorded on every row
- Standard
- GLOBAL-Entity-Grid-Standard-v1.1.md
- Built
- 2026-08-15
Segment Scope
In: every offering whose fact record passed validation and carries the row class Observed — 147 rows across 111 organisations.
Out: 51 Variant rows, which are named in their own band below but carry no cells; and every Counterfactual row, which is internal and is never emitted at all.
On what basis: the row-class publication gate. A grid builder that simply iterated the source records would emit rows nobody measured — on the thirteen-entity pilot it produced nineteen rows for thirteen organisations, four of them fabricated, two of which made an organisation look better than its evidence supported. The gate is applied by the builder itself rather than inherited from the validator, because a consumer that trusts an upstream check is a consumer with no check.
What This Grid May Not Be Used For
It Is Not A Rating, A Score, A Grade Or A Ranking
Every cell is a publication state. There is no total, no average and no league position, and none may be computed from it. The rows are alphabetical for that reason, and no other ordering is offered.
It Is Not A Compliance Determination
Nothing here alleges that any organisation has breached any law. An Absent cell records that a document was not found on the public record at a stated date, by a stated method.
It Is Not A Substitute For The Deep Dive
The grid carries no limitations table, no right of reply and no evidence. A decision about a named supplier is taken on that supplier's own assessment. The grid's job is to tell a buyer which assessment to read.
No Cell May Be Quoted Without Its Date And Its Generation
A cell without its evidence cutoff and its method generation is not a fact, it is a claim. Both travel on every row here, and both are carried into the row's full reading.
How To Read A Cell
AdverseA finding on the public record.
PartialDisclosed, but incompletely.
StrongDisclosed and closed.
NeutralMeasured; the field does not apply.
Not MeasuredNever assessed. An unchecked field is not a clean one.
An Empty-Looking Answer Has Three Meanings, And They Never Render Alike
- Absent — measured; the organisation does not publish it. This is a finding.
- Never Asked — the method generation that produced the row never put the question. The cell names the generation, so a reader knows which rows compare with which. This is a fact about our coverage.
- Not Researched — the reference set does not cover the organisation on that question at all. This is a fact about the reference set.
A fourth answer is not an absence: Does Not Arise means the question was put and does not apply to the offering — there was never anything that could have been published. It bands Neutral and is a completed reading, not a gap.
Subprocessors130
Subprocessor List
List Completeness
| Organisation | Offering | Subprocessor List | List Completeness | Subprocessor Locations | As At | Reading |
|---|---|---|---|---|---|---|
| Airwallex | Airwallex Platform (Business Accounts, Payments, Spend, Billing, Platform APIs and Embedded Finance) | Published | Open-Ended | Partial | 2026-08-10v1.6 | |
| Amazon Web Services | Amazon Web Services — global commercial cloud platform, including Bedrock, Q and SageMaker | Published | Open-Ended | All Named | 2026-08-13v1.6 | |
| Asana | Asana work management platform (asana.com), default configuration with Asana AI enabled | Published | Closed | All Named | 2026-08-11v1.6 | |
| Atlassian | Atlassian Cloud (Jira, Jira Service Management, Confluence, Bitbucket, Trello, Loom, Opsgenie, Statuspage, Compass, Jira Align, Jira Product Discovery, Atlassian Intelligence and Rovo) | Published | Closed | Partial | 2026-08-10v1.6 | |
| Auth0 | Auth0 Customer Identity Cloud (contracted, Master Subscription Agreement plus executed Data Processing Addendum) | Published | Closed | All Named | 2026-08-07v1.6 | |
| beehiiv | beehiiv (newsletter and publishing platform, including beehiiv AI features) | Published | Open-Ended | All Named | 2026-08-13v1.6 | |
| Black Kite | Black Kite Platform (hosted third-party cyber risk intelligence, blackkite.com) | Published | Closed | All Named | 2026-08-08v1.6 | |
| Box | Box (core content and collaboration platform, including Box AI) | Published | Closed | Partial | 2026-08-13v1.6 | |
| Calendly | Calendly (scheduling platform, Notetaker and hosted MCP server) | Published | Open-Ended | All Named | 2026-08-11v1.6 | |
| Canva | Canva Platform — Free / Pro individual account | Published | Closed | All Named | 2026-08-13v1.6 | |
| Cerebras | Cerebras Inference and Training-as-a-Service (cloud.cerebras.ai / inference.cerebras.ai / api.cerebras.ai) — Cerebras CS-3 on-premises hardware and software-for-hardware are a separate offering and are out of scope of this assessment | Published | Closed | None Named | 2026-08-13v1.6 | |
| ClariDuty 365 | ClariDuty 365 | Absent | Not Assessable | No List To Assess | 2026-08-13v1.6 | |
| Clay | Clay Platform (hosted, clay.com) — data enrichment, AI research agents and outbound workflow automation | Published | Closed | All Named | 2026-08-11v1.6 | |
| ClickUp | ClickUp hosted platform, including ClickUp Brain, Super Agents, Ambient Agents, AI Notetaker, Enterprise Search and the first-party MCP server | Published | Closed | All Named | 2026-08-10v1.6 | |
| Cloudflare | Cloudflare Platform (self-serve and Enterprise, cloudflare.com) | Published | Closed | Partial | 2026-08-07v1.6 | |
| Comp AI | Comp AI Platform (compliance automation for SOC 2, ISO 27001, HIPAA and GDPR; includes a first-party MCP server) | Published | Closed | All Named | 2026-08-13v1.6 | |
| Confluent | Confluent Cloud | Published | Closed | Partial | 2026-08-15v1.6 | |
| CoreWeave | CoreWeave Cloud Platform (GPU/AI infrastructure-as-a-service, inclusive of CoreWeave Inference and CoreWeave AI Object Storage; Weights & Biases MLOps operates under CoreWeave's own Privacy Policy following the completed acquisition) | Published | Closed | All Named | 2026-08-13v1.6 | |
| Databricks | Databricks Data Intelligence Platform (hosted Platform Services and Support Services, all supported clouds) | Published | Closed | Partial | 2026-08-11v1.6 | |
| Datadog | Datadog (observability, security and Bits AI agent platform, datadoghq.com) | Published | Open-Ended | All Named | 2026-08-15v1.6 | |
| DataGrail | DataGrail Platform (hosted, app.datagrail.io) | Absent | Not Assessable | None Named | 2026-08-08v1.6 | |
| DeepSeek | DeepSeek chat app, web app, and Open Platform API (single global service, no regional or hosting variant published) | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | |
| Deputy | Deputy Workforce Management Platform | Published | Closed | All Named | 2026-08-07v1.6 | |
| Docusign | Docusign eSignature and the Intelligent Agreement Management platform (hosted, docusign.com), including the in-product AI features | Published | Closed | All Named | 2026-08-11v1.6 | |
| Docusign | The Docusign MCP server (Open Beta, mcp.docusign.com) — 22 production tools served to an AI assistant the customer brings | Published | Closed | All Named | 2026-08-11v1.6 | |
| Dropbox | Dropbox Dash | Published | Closed | All Named | 2026-08-11v1.6 | |
| Dropbox | Dropbox For Teams | Published | Closed | All Named | 2026-08-11v1.6 | |
| ElevenLabs | ElevenLabs Enterprise (Business/Processor Relationship, Custom Data Residency) | Published | Open-Ended | Partial | 2026-08-15v1.6 | |
| ElevenLabs | ElevenLabs Self-Serve (Free, Starter, Creator, Pro, Scale, Business — Individual/Non-Enterprise) | Published | Open-Ended | All Named | 2026-08-15v1.6 | |
| Employment Hero | Employment Hero Platform (Employment OS — HR, payroll, workforce management, AI Recruitment Agent, ATS, EH Work app, EH Jobs) | Published | Closed | All Named | 2026-08-11v1.6 | |
| Fathom | Fathom AI meeting assistant (web application, desktop and mobile applications, meeting recording bot, Fathom REST API, MCP server, webhooks and customer-configured CRM integrations) | Published | Closed | All Named | 2026-08-14v1.6 | |
| Fillout | Fillout (forms, scheduling, workflows, AI form builder, Form Agent) and Zite app building — one platform operated by Restly, Inc. | Published | Closed | Partial | 2026-08-14v1.6 | |
| Fireflies.ai | Fireflies.ai Platform (meeting transcription and notes, Voice Agents, AI Skills, AI Assistant, Slack Assistant and public API) | Published | Closed | All Named | 2026-08-15v1.6 | |
| Fireworks AI | Fireworks AI Platform | Published | Closed | Partial | 2026-08-11v1.6 | |
| Fivetran | Fivetran SaaS data movement platform, including Fivetran Activations (formerly Census), Context Layer and Agent Context MCP (both Public Preview) | Published | Closed | Partial | 2026-08-11v1.6 | |
| Formstack | Formstack Forms, Documents, Sign and Workflows (including Forms for Salesforce and Documents for Salesforce), operated under a single Software Services Agreement, DPA and Privacy Policy by Intellistack, LLC (formerly Formstack, LLC); the same instruments and the same published sub-processor list also cover the Intellistack Streamline and Formsite product lines, confirmed on the same sub-processor table | Published | Closed | None Named | 2026-08-15v1.6 | |
| GitHub | GitHub platform and GitHub Copilot, volume-licensed (Enterprise, Business, GitHub Customer Agreement) | Published | Closed | All Named | 2026-08-07v1.6 | |
| Google Cloud | Google Workspace and Google Cloud Platform (single Cloud DPA; also covers Cloud Identity, SecOps, Looker) — consumer products out of scope | Published | Closed | All Named | 2026-08-13v1.6 | |
| Groq | GroqCloud AI Inference Platform (console.groq.com / api.groq.com / GroqChat), including the Compound agentic system — Groq LPU hardware sales and on-premises/offline-terms deployments are a separate offering and out of scope of this assessment | Published | Closed | Partial | 2026-08-15v1.6 | |
| Haast | Haast Compliance Platform (AI-powered marketing and communications compliance review, pre-publication content scanning, live digital-footprint monitoring, and regulatory horizon scanning) | Absent | Not Assessable | No List To Assess | 2026-08-13v1.6 | |
| HubSpot | HubSpot CRM / Marketing / Sales / Service / Content / Operations Hubs (hosted, hubspot.com), including Clearbit-brand enrichment products and HubSpot AI features | Published | Closed | Partial | 2026-08-13v1.6 | |
| Intercom | Intercom customer service platform — default (United States) hosting, including Fin AI Agent, Fin Voice AI Agent, Copilot, the Intercom MCP server and Data Connectors | Published | Closed | All Named | 2026-08-11v1.6 | |
| iubenda | iubenda Privacy & Cookie Policy Generator and surrounding legal/consent product suite (Privacy Controls and Cookie Solution, Consent Database, Data Subject Rights Management Tool, Whistleblowing Management Tool, Accessibility Widget) | Published | Closed | Partial | 2026-08-13v1.6 | |
| Jotform | Jotform (hosted form-builder platform, jotform.com) | Published | Closed | None Named | 2026-08-13v1.6 | |
| LinkedIn Platform — Individual Member (linkedin.com, core service) | Absent | Not Assessable | No List To Assess | 2026-08-13v1.6 | ||
| Loom | Loom on the Atlassian platform (Loom AI available) | Published | Closed | All Named | 2026-08-11v1.6 | |
| Lunary | Lunary Cloud (app.lunary.ai) | Published | Closed | All Named | 2026-08-11v1.6 | |
| Mailgun | Mailgun Platform (Sinch Email) — hosted API and dashboard, EU region selected | Published | Closed | All Named | 2026-08-11v1.6 | |
| Make | Make Cloud Platform (hosted, make.com) | Published | Closed | All Named | 2026-08-10v1.6 | |
| Microsoft | Microsoft Enterprise Cloud Services (Microsoft 365 incl. Copilot, Entra, Azure incl. Azure AI Foundry, Dynamics 365, Power Platform) — default configuration | Gated | Not Assessable | No List To Assess | 2026-08-15v1.6 | |
| MiniMax | MiniMax Open Platform (API) and consumer AI products, no plugin connector | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | |
| Miro | Miro cloud platform (Free, Starter, Business and Enterprise plans, including Miro AI and the Miro MCP Server) | Published | Open-Ended | All Named | 2026-08-14v1.6 | |
| Mistral AI | Mistral AI Studio / La Plateforme API (Commercial, Governed By Commercial Terms + DPA) | Published | Closed | Partial | 2026-08-15v1.6 | |
| Mistral AI | Mistral Vibe (Consumer/Prosumer Chat And Agent — Formerly Le Chat) | Published | Closed | Partial | 2026-08-15v1.6 | |
| monday.com | monday.com Work OS — Platform Services (work management, CRM, dev, service, WorkCanvas, WorkForms, monday code) | Published | Closed | Partial | 2026-08-10v1.6 | |
| MongoDB | MongoDB Atlas (hosted Cloud Services) | Published | Closed | Partial | 2026-08-11v1.6 | |
| Moonshot AI | Kimi consumer assistant (kimi.com and Kimi apps, operated by Beijing Moonshot Technology Co., Ltd.) | Published | Open-Ended | None Named | 2026-08-15v1.6 | |
| Moonshot AI | Kimi Open Platform / API and Kimi Business enterprise cooperation, including the Kimi Code CLI agent tool (platform.kimi.ai, operated by Moonshot AI PTE. LTD., Singapore) | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | |
| MYOB | MYOB Acumatica (enterprise ERP) | Absent | Not Assessable | No List To Assess | 2026-08-10v1.6 | |
| MYOB | MYOB Business (Lite, Pro, AccountRight, Payroll Only) | Absent | Not Assessable | No List To Assess | 2026-08-10v1.6 | |
| MYOB | MYOB Business API and Developer Program (third-party acting surface) | Absent | Not Assessable | No List To Assess | 2026-08-10v1.6 | |
| MYOB | MYOB Payment Services | Absent | Not Assessable | No List To Assess | 2026-08-10v1.6 | |
| n8n | n8n Cloud (hosted, app.n8n.cloud) | Published | Closed | All Named | 2026-08-07v1.6 | |
| Notion | External Agents in Notion — Claude agents and Cursor agents | Published | Closed | None Named | 2026-08-10v1.6 | |
| Notion | Notion Calendar and Notion Mail | Published | Closed | Partial | 2026-08-10v1.6 | |
| Notion | Notion workspace and Notion AI (hosted, notion.com / notion.so) | Published | Closed | Partial | 2026-08-10v1.6 | |
| NVIDIA | NVIDIA AI Enterprise / DGX Cloud / Omniverse on DGX Cloud / NVIDIA Brev (enterprise AI infrastructure, governed by the NVIDIA Cloud Services Data Processing Addendum) | Published | Closed | Partial | 2026-08-15v1.6 | |
| NVIDIA | NVIDIA Consumer Products And Services (nvidia.com account, GeForce Experience, GeForce NOW, NVIDIA App, SHIELD, on-site/in-app chatbots, event and marketing data) | Absent | Not Assessable | None Named | 2026-08-15v1.6 | |
| NVIDIA | NVIDIA Developer Program / NGC / API Catalog (build.nvidia.com trial and hosted NIM inference APIs, governed by the NVIDIA Technology Access Terms of Use and the NVIDIA API Trial Terms of Service) | Absent | Not Assessable | None Named | 2026-08-15v1.6 | |
| Obsidian | Obsidian App — Local Vault Only | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | Not Measured Under Method v1.6Never Asked | 2026-08-11v1.6 | |
| Obsidian | Obsidian Publish | Absent | Not Assessable | No List To Assess | 2026-08-11v1.6 | |
| Obsidian | Obsidian Sync | Absent | Not Assessable | No List To Assess | 2026-08-11v1.6 | |
| Odoo | Odoo Cloud Platform — Odoo Online and Odoo.sh hosting of the Odoo Enterprise ERP/CRM/business-application suite (odoo.com), including the built-in Odoo AI application (Gemini/OpenAI-backed, Odoo 19). The separately-priced, credit-billed In-App Purchase (IAP) feature set (SMS, document digitization, partner autocomplete, legacy AI text tools) carries its own distinct privacy policy and subprocessor list and is flagged, not analysed, at §3.13 | Published | Closed | Partial | 2026-08-15v1.6 | |
| Okta | Okta Customer Identity Cloud (Auth0), including the Fine-Grained Authorization, Breached Password Detection and Guide add-ons, on the public-cloud regions and the private-cloud region set | Published | Open-Ended | Partial | 2026-08-14v1.6 | |
| Okta | Okta Workforce Identity Cloud (including Identity Governance, Privileged Access, Advanced Server Access and Identity Security Posture Management) | Published | Open-Ended | Partial | 2026-08-14v1.6 | |
| OpenAI | ChatGPT Free, Plus and Pro consumer tiers, governed by the European and global consumer privacy policies | Published | Closed | Partial | 2026-08-13v1.6 | |
| OpenAI | OpenAI API, Business and Enterprise tiers, governed by the Customer Data Processing Addendum effective 1 January 2026 | Published | Closed | Partial | 2026-08-13v1.6 | |
| Oracle | Oracle Cloud Services (DPA estate) | Gated | Not Assessable | None Named | 2026-08-11v1.6 | |
| Oracle | Oracle MCP and agentic surface | Gated | Not Assessable | None Named | 2026-08-11v1.6 | |
| Oracle | oracle.com corporate and account surface | Absent | Not Assessable | No List To Assess | 2026-08-11v1.6 | |
| PayPal | PayPal-branded wallet and checkout services, Braintree ("Unbranded Payment Services"), Fastlane, Hyperwallet, Xoom, and PayPal Point of Sale / Zettle, together with the PayPal MCP agent surface at mcp.paypal.com, all governed by PayPal's global Privacy Statement and by the parallel Payment/Card Processing Data Protection Addenda. Venmo is an Excluded Service under PayPal's own Privacy Statement and is out of scope for this report. | Published | Open-Ended | Partial | 2026-08-13v1.6 | |
| Perplexity | Perplexity Enterprise and API offerings, governed by the Data Processing Addendum (DPA) last updated August 13, 2026 | Published | Closed | All Named | 2026-08-15v1.6 | |
| Perplexity | Perplexity Free, Pro and Max consumer tiers, governed by the consumer Privacy Notice last updated July 8, 2026 | Published | Closed | All Named | 2026-08-15v1.6 | |
| ProcessUnity | ProcessUnity Global Risk Exchange | Published | Open-Ended | Partial | 2026-08-08v1.6 | |
| ProcessUnity | ProcessUnity TPRM Platform | Published | Open-Ended | Partial | 2026-08-08v1.6 | |
| QuickBooks | QuickBooks Online (EN-ROW and European route) | Absent | Not Assessable | No List To Assess | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online (United Kingdom route) | Absent | Not Assessable | No List To Assess | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online (United States and Canada route) | Absent | Not Assessable | No List To Assess | 2026-08-10v1.6 | |
| QuickBooks | QuickBooks Online Payroll and QuickBooks Time (processor route) | Gated | Not Assessable | None Named | 2026-08-10v1.6 | |
| Qwen | Qwen Chat / Qwen Studio — consumer and self-service AI chat and generation product | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | |
| Recall.ai | Recall.ai Platform (Meeting Bot API, Desktop and Mobile Recording SDKs, Calendar API, Output Media, MCP server) | Published | Closed | All Named | 2026-08-11v1.6 | |
| Reddit Advertising (Ads Manager, Business Tools, Custom Audiences) | Published | Closed | Partial | 2026-08-15v1.6 | ||
| Reddit consumer platform (reddit.com and Reddit apps, including Reddit Answers) | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | ||
| Reddit Developer Platform and Data API (Devvit, third-party apps, Data API licensees) | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | ||
| Relyance | Relyance Platform (relyance.ai) | Gated | Not Assessable | No List To Assess | 2026-08-08v1.6 | |
| Salesforce | Agentforce and the Einstein Generative AI Services | Published | Closed | Partial | 2026-08-11v1.6 | |
| Salesforce | Salesforce Services on Hyperforce | Published | Closed | Partial | 2026-08-11v1.6 | |
| SAP | SAP Cloud Services (global default configuration, including SAP Business AI and Joule) | Gated | Not Assessable | Partial | 2026-08-08v1.6 | |
| Sentry | Codecov (software test coverage reporting, about.codecov.io) | Published | Closed | All Named | 2026-08-11v1.6 | |
| Sentry | Sentry (application monitoring and error tracking, sentry.io) | Published | Closed | All Named | 2026-08-11v1.6 | |
| ServiceNow | ServiceNow AI Platform — general Subscription Service | Published | Open-Ended | Partial | 2026-08-14v1.6 | |
| Slack | Slack (commercial cloud, slack.com, including Slack AI and Slackbot) | Published | Open-Ended | Partial | 2026-08-07v1.6 | |
| SmartSuite | SmartSuite Platform (hosted at smartsuite.com) — direct customer channel | Published | Closed | All Named | 2026-08-07v1.6 | |
| Snowflake | Snowflake AI Data Cloud, including Cortex AI Features | Published | Closed | Partial | 2026-08-11v1.6 | |
| Softr Platforms GmbH | Softr No-Code Application Platform (hosted, softr.io) | Published | Closed | All Named | 2026-08-07v1.6 | |
| Stripe | Stripe hosted platform (payments, Connect, Identity, Terminal, Issuing, Atlas, Treasury) including the hosted MCP server at mcp.stripe.com | Published | Open-Ended | Partial | 2026-08-07v1.6 | |
| Supabase | Supabase Platform (hosted, supabase.com) | Published | Closed | None Named | 2026-08-07v1.6 | |
| Tailscale | Tailscale Aperture (AI gateway, beta) | Published | Closed | Partial | 2026-08-11v1.6 | |
| Tailscale | Tailscale Solution (hosted coordination service and tailnet) | Published | Closed | Partial | 2026-08-11v1.6 | |
| TaskUs | TaskUs BPO / AI Data Services (client-contracted) and the taskus.com corporate website | Absent | Not Assessable | No List To Assess | 2026-08-13v1.6 | |
| Teamwork.com | Teamwork Desk — AI-powered features | Published | Closed | None Named | 2026-08-11v1.6 | |
| Teamwork.com | Teamwork.com Platform (projects, resource, Chat, Spaces, TeamworkAI, MCP server) | Published | Closed | None Named | 2026-08-11v1.6 | |
| TikTok | TikTok Platform — EEA / UK / Switzerland User (TikTok Technology Limited and TikTok Information Technologies UK Limited, joint controllers) | Published | Closed | All Named | 2026-08-15v1.6 | |
| Trello | Trello Cloud, Standard and Premium Workspaces (AI activated by default) | Published | Closed | Partial | 2026-08-10v1.6 | |
| Twilio | Twilio platform (Programmable Messaging, Programmable Voice, Verify, Flex, Segment, Stytch and the AI/ML Features), contracted with Twilio Ireland Limited | Published | Open-Ended | Partial | 2026-08-11v1.6 | |
| Whimsical | Whimsical (visual workspace: boards, docs, flowcharts, wireframes, mind maps, including Whimsical AI) | Published | Closed | All Named | 2026-08-15v1.6 | |
| Whispir | Whispir Platform (hosted, whispir.com) | Gated | Not Assessable | No List To Assess | 2026-08-07v1.6 | |
| Whistic | Whistic TPRM AI Platform (hosted, whistic.com) including Whistic AI and the Whistic MCP Server (BETA) | Published | Closed | All Named | 2026-08-10v1.6 | |
| Wrike | Klaxoon, The Separately Activated Wrike Affiliate Brand | Published | Closed | Partial | 2026-08-14v1.6 | |
| Wrike | Wrike Work Management Platform, With Wrike AI And AI Agents | Published | Closed | Partial | 2026-08-14v1.6 | |
| Xano | Xano Agents, MCP Builder, MCP Server and Developer MCP (customer-supplied credentials) | Published | Closed | All Named | 2026-08-11v1.6 | |
| Xano | Xano Platform (hosted backend), including the vendor-selected Xano AI features | Published | Closed | All Named | 2026-08-11v1.6 | |
| Xero | Xero (hosted accounting platform, xero.com), including JAX | Published | Closed | Partial | 2026-08-10v1.6 | |
| Zapier | Zapier Automation Platform (hosted, zapier.com — Zap workflows, Tables, Forms, Canvas, Agents, Chatbots, MCP, SDK, Functions) | Published | Closed | All Named | 2026-08-10v1.6 | |
| Zendesk | Zendesk — customer service and CRM platform (Support, Guide, Talk, Chat, Sell), including Zendesk AI Agents and the first-party MCP server/client | Published | Open-Ended | Partial | 2026-08-15v1.6 | |
| Zhipu AI | Z.ai API / Enterprise (GLM API) | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | |
| Zhipu AI | Z.ai Consumer Chatbot (chat.z.ai) | Absent | Not Assessable | No List To Assess | 2026-08-15v1.6 | |
| Zhipu AI | Zhipu Domestic Platform (bigmodel.cn) | Published | Closed | Partial | 2026-08-15v1.6 | |
| Zoho | Zoho Cloud Suite with Zia AI | Published | Closed | Partial | 2026-08-10v1.6 | |
| Zoom | Zoom Workplace (hosted, zoom.com) — Federated AI deployment | Published | Closed | All Named | 2026-08-07v1.6 |
State Access — A Separate Band
Origin is not destination. An elevated origin yields Cannot Assess, never No Lawful Route. Nationality, ownership or founder origin may never ground an elevated finding.
Classification rests on documented ownership and statutory obligation only — never founder nationality, ethnicity or personal origin.
State-Access (Stakeholder) — Not Researched on all 147 rows
Basis, recorded identically on every row: “not researched under the method — no documented ownership or statutory-obligation finding on the record”.
The band holds one value because the 9,363-row reference set that could have filled it says on 9,336 of its own rows that the value is a mechanical default rather than a verified absence. A lookup against it could not tell “checked and clean” from “never checked”, so it would have published a clean result nobody measured. And the file sits outside the repository, so the same records built on two machines produced two different published wordings — a cell whose basis depends on the build host is not a fact about anyone. The builder no longer opens it. When stakeholder control is genuinely researched it enters through a fact record like every other observation, cited, dated and carrying its claim tier.
Conditional Rows, Named But Not Celled51
Hosting Locality23
United States Government CloudAtlassian Government CloudInfrastructure and support operated exclusively within the EU by EU-resident personnel under Amazon Data Services European Sovereign Cloud GmbH (Germany); support limited to Amazon Development Centre Ireland Limited and Amazon Web Services EMEA SARL; third-party service providers limited to the EU/EEA-region entities of the same messaging vendors named on the main platform's list.AWS European Sovereign Cloud — distinct legal entity, EU-resident governance and personnel, separate and shorter sub-processor listEuropean Union — AWS Dublin, IrelandClickUp Enterprise Plan with the European hosting region selectedEU Regional Services + Customer Metadata Boundary (Enterprise paid add-on)Cloudflare Platform — Enterprise with Data Localization SuiteUnited Kingdom regionEmployment Hero Platform — United Kingdom region (Employment Hero (UK) Ltd, HR data in Australia and Ireland, payroll primarily Ireland)EU or Australia regionGitHub Enterprise Cloud with data residency (GHE.com)Existing workspace (residency unreachable)Loom — an existing workspace, which cannot be migrated to a pinned data regionTenant provisioned in the EU/EFTA Macro Region Geography with an EU/EFTA billing address, bringing Microsoft 365, Entra, Azure regional services, Dynamics 365 and Power Platform in-scope for the EU Data BoundaryMicrosoft Enterprise Cloud Services — EU Data Boundary provisioningEuropean Union data residency (Ireland primary, Germany backup)Miro cloud platform — European Union data residency hosting localityNew ZealandMYOB Business — New Zealand hosting localityEurope (Frankfurt)Obsidian Sync — Europe (Frankfurt) hosting_localityEuropean Cell — Germany and Ireland for hosting and the data warehouse, Belgium and the Netherlands additionally for Identity Governance and Privileged Access. A configuration a customer can select today, taken without the Customer Identity Cloud and without the Service Log Investigator or any other generative-AI feature enabled.Okta Workforce Identity Cloud — European Cell hosting locality, without the Customer Identity Cloud and with no generative-AI feature enabledCustomer Content in Ireland or Australia; all other account and usage data in the United StatesRegional Twilio — supported products with Customer Content stored in the selected region (Ireland or Australia)Hyperforce EU Operating Zone selected by the customerSalesforce Services in a Hyperforce EU Operating ZoneEU Access — optional, per-service, chargeable, EEA and SwitzerlandSAP Cloud Services — EU Access optionSAP NS2 — processing confined to US locations and US personnelSAP Cloud Services — SAP National Security Services (US locations and US personnel)European Union (Frankfurt, Germany) selected as the organisation's Data Storage Location at creationSentry with the European Union data storage location selected (de.sentry.io, Frankfurt)Australia — protected platform offeringServiceNow Protected Platform AustraliaRest Of World / Australia — TikTok Pte. Ltd. (Singapore)TikTok Platform — Rest Of World / Australia User (TikTok Pte. Ltd., Singapore, controller)United States — TikTok USDS Joint Venture LLCTikTok Platform — United States User (TikTok USDS Joint Venture LLC, operator since 22 January 2026)Account pinned to a customer-selected region or territory, as described on the Singapore security pageWhispir Platform — region-pinned account (residency option as described on the Singapore security page)European Data Centre (Amsterdam primary, Dublin secondary)Zoho Cloud Suite — European data centre tenancyEU-HostedZoom Workplace — EU-hosted account (Zoom-Hosted Models Plus)
Deployment Mode23
AI agent operating on the production account through the AgentOS MCP connectorsAirwallex Platform (Business Accounts, Payments, Spend, Billing, Platform APIs and Embedded Finance) — AgentOS production-account connectors deployment modeAsana AI preferences switched off for the domain in the admin consoleAsana work management platform with Asana AI disabled at the domain level by an adminSelf-Managed (Data Center)Atlassian Data Center (customer-operated, self-managed)Early Access AI Agent add-onAuth0 for AI Agents and Okta for AI Agents (Early Access add-on)Self-managed. The customer installs and operates the software on its own infrastructure under the Confluent Platform Agreement (Last Updated April 24, 2024) rather than under the Cloud Services Agreement, and Confluent hosts no customer topic data. Confluent nonetheless collects Usage Data and, unless disabled, Telemetry Metrics from the customer's own installation.Confluent Platform — the self-managed distribution installed on the customer's own infrastructureSelf-HostedFireworks AI — Bring Your Own Cloud (BYOC) deploymentHybrid DeploymentFivetran Hybrid Deployment - pipeline processing inside the customer's own network, orchestrated from Fivetran's cloudDedicatedLunary Dedicated (managed by Lunary in a customer-chosen region)Self-HostedLunary Self-Hosted (Enterprise Edition, customer infrastructure)MCP Server ConnectedMailgun Platform with the published MCP server connected (customer-hosted, model in the loop)On-Premises AgentMake (on-premises agent) — Variant of Make Cloud PlatformPlugin Marketplace connector enabledMiniMax Agent (agent.minimax.io) with a Plugin Marketplace connector enabledAI features enabledmonday AI Work Platform (AI features and agents, enabled per account)Self-HostedMongoDB self-managed (Enterprise Advanced and Community Edition)AccountRight subscriptionMYOB Business — AccountRight subscription deployment modeSelf-Hosted on customer infrastructure. The n8n-operated AI Assistant is not available, and product telemetry is enabled by default.n8n (self-hosted)Asia PacificOneTrust LLC — Asia Pacific deployment modeZero data retention enabled as an API configuration — an option the customer must switch on, not the default state of the offeringOpenAI API with zero data retention enabled (Variant of the API, Business and Enterprise baseline)SendGrid Services and Private Beta Offerings — same platform, same instruments, except that the BCR route is expressly unavailableSendGrid Services and Private Beta Offerings — the Services expressly carved out of the Binding Corporate RulesSold and administered through a business partner or reseller under the 13 March 2025 partner instruments rather than the 1 January 2026 Customer DPASmartSuite Platform — partner and reseller channel (Business Partner DPA / Reseller DPA)Self-HostedSupabase (self-hosted)Self-HostedTeamwork.com MCP server (self-hosted from the published repository)Agent Execution Surface (Model Context Protocol)Zoho MCP — agent execution surface
Commercial Tier5
Individual (non-volume-licensed)GitHub individual accounts and GitHub Copilot Free, Pro and Pro+Enterprise B2B SubscriberLinkedIn Platform — Individual Member — Enterprise B2B Subscriber commercial_tier (Sales Navigator, Recruiter/Talent Solutions, Learning Solutions, Marketing Solutions, Glint)FreeTrello Cloud, Free planReseller channel — the published Data Processing Addendum is disapplied by its own termsWrike Purchased Through A Wrike PartnerCompany or Enterprise planZapier Automation Platform on the Company or Enterprise plan
Correction, Right Of Reply, And Free-And-First
The finding goes to the organisation free and first. An organisation that disputes a cell gets the same route as one disputing a report: the correction is published with a version note, and where a document is produced the reading is re-run. Every organisation’s own record carries the route.
Nothing on this page is behind a sign-in, a price or an account, and nothing on it ever will be. Comparison at this depth is the free layer; what is sold is the reading that goes deeper, never a better answer on this one.