Loading …
Last updated September 3, 2026
Mahoney Control uses the third parties below to deliver the service. For each one this page states what it processes and where. Where a location depends on how this deployment is configured rather than on the vendor, it is read from that configuration and shown as not declared until it has been declared — an undeclared region is never rendered as a region.
Under the partner agreement (Schedule B, §B8) we give thirty days’ notice before adding or replacing a sub-processor, and a partner or end customer who objects on data protection grounds within that period may raise it with us at legal@mahoney-it.com.
A tenant carries a residency region (EU, US or Asia). Today that value is a declaration: it drives currency, pricing and the region a customer is recorded under, and it does not yet place that customer’s data in a separate regional database — all tenants share one production database in the region named above. Per-region data storage is planned and not built; this page will say so until it is.
| Processor | What it does | What it processes | Where |
|---|---|---|---|
| Supabase | Managed Postgres, authentication and file storage — the Platform’s database. | Everything the Platform stores: accounts, tenants, connector telemetry, tickets, documents, audit log. | Single production project, region not declared |
| Vercel | Application hosting, serverless functions, scheduled jobs, custom domains, and cookieless page analytics on the public marketing pages. | Request data in transit, function logs, the custom-domain records of white-label partners, and page paths plus funnel step names from the public marketing pages (no cookies, no query strings, nothing typed into a form). | Functions in region not declared |
| Anthropic | The AI analysis in the Platform — briefings, the coordinator, the CISO assessment. | The prompt content sent for a given analysis: security posture figures, alert and ticket summaries, and the customer and device names inside them. | United States |
| OpenAI | Text embeddings for the knowledge base (default embedding provider), and the independent second finding on SOC alerts (SecOps triage). | The text of knowledge-base and runbook passages being embedded; for SOC triage, the alert facts with host names, user names, IP and e-mail addresses and the customer name replaced by placeholders. | United States for embeddings; SOC triage runs in a project with European data residency when OPENAI_BASE_URL points at the EU endpoint |
| Amazon Web Services (Bedrock) | Runs the Claude analysis inside a chosen AWS region, so a customer recorded under EU residency can have its AI processing stay in the EU. | The same prompt content as the Anthropic entry above — posture figures, alert and ticket summaries, and the customer and device names inside them — for customers this deployment routes here. | The configured AWS region; EU customers are contracted through AWS EMEA SARL (Luxembourg) |
| Microsoft Azure OpenAI | Alternative embedding provider, selectable per deployment and — for an EU region — per customer. | The same passages as above, when this provider is selected. | The region of the configured Azure endpoint |
| Mistral AI | Alternative embedding provider, selectable per deployment. | The same passages as above, when this provider is selected. | France (European Union) |
| Microsoft (Graph, Entra, Defender) | Reading the customer’s own Microsoft tenant: sign-ins, directory audits, identity risk, security alerts, licences. | Data that already lives in the customer’s Microsoft tenant. Mahoney reads it and stores the security-relevant subset in the database above. | The customer’s own Microsoft tenant region |
| Microsoft Azure Key Vault | Envelope encryption keys for helpdesk ticket content (not yet enabled). | Encryption keys only — never ticket content itself. | The region of the configured vault |
| Resend | Transactional e-mail — invitations, notifications, contract links. | Recipient name and e-mail address, and the content of the message sent. | United States |
| Mailchimp (Intuit) | Newsletter delivery — news about the platform, sent only after an approval, to people who were picked or tagged for it. | Recipient e-mail address, language, the audience tag and an unsubscribe state; the newsletter content. For a partner newsletter, the partner uses its own Mailchimp account. | United States |
| Stripe | Subscription billing, usage metering, and partner payouts (Connect). | Billing contact, subscription and usage records. Card data never reaches Mahoney. For a partner payout account: the partner admin's e-mail address, the partner's country and our partner id, sent when the account is created — the identity and bank details behind it the partner gives Stripe directly. | United States |
| PayPal | Alternative payment method for subscriptions. | Billing contact and subscription records. Card data never reaches Mahoney. | United States |
| Intuit QuickBooks | Accounting export and payment onboarding, where the operator connects it. | Invoice and customer billing records. | United States |
| Google Maps Platform | Address autocomplete and distance calculation on site records. | The address text typed into an address field. | United States |
Data a customer’s own systems hold — their Microsoft tenant, their RMM, their EDR — stays with those systems; Mahoney reads the security-relevant subset and stores it in the database named above. See the privacy policy for what is collected, why, and how long it is kept.