Last updated September 3, 2026
Mahoney Control uses the third parties below to deliver the service. For each one this page states what it processes and where. Where a location depends on how this deployment is configured rather than on the vendor, it is read from that configuration and shown as not declared until it has been declared — an undeclared region is never rendered as a region.
Under the partner agreement (Schedule B, §B8) we give thirty days’ notice before adding or replacing a sub-processor, and a partner or end customer who objects on data protection grounds within that period may raise it with us at legal@mahoney-it.com.
A tenant carries a residency region (EU, US or Asia). Today that value is a declaration: it drives currency, pricing and the region a customer is recorded under, and it does not yet place that customer’s data in a separate regional database — all tenants share one production database in the region named above. Per-region data storage is planned and not built; this page will say so until it is.
| Processor | What it does | What it processes | Where |
|---|---|---|---|
| Supabase | Managed Postgres, authentication and file storage — the Platform’s database. | Everything the Platform stores: accounts, tenants, connector telemetry, tickets, documents, audit log. | Single production project, region not declared |
| Vercel | Application hosting, serverless functions, scheduled jobs and custom domains. | Request data in transit, function logs, and the custom-domain records of white-label partners. | Functions in region not declared |
| Anthropic | The AI analysis in the Platform — briefings, the coordinator, the CISO assessment. | The prompt content sent for a given analysis: security posture figures, alert and ticket summaries, and the customer and device names inside them. | United States |
| OpenAI | Text embeddings for the knowledge base (default embedding provider). | The text of knowledge-base and runbook passages being embedded. | United States |
| Amazon Web Services (Bedrock) | Runs the Claude analysis inside a chosen AWS region, so a customer recorded under EU residency can have its AI processing stay in the EU. | The same prompt content as the Anthropic entry above — posture figures, alert and ticket summaries, and the customer and device names inside them — for customers this deployment routes here. | The configured AWS region; EU customers are contracted through AWS EMEA SARL (Luxembourg) |
| Microsoft Azure OpenAI | Alternative embedding provider, selectable per deployment and — for an EU region — per customer. | The same passages as above, when this provider is selected. | The region of the configured Azure endpoint |
| Mistral AI | Alternative embedding provider, selectable per deployment. | The same passages as above, when this provider is selected. | France (European Union) |
| Microsoft (Graph, Entra, Defender) | Reading the customer’s own Microsoft tenant: sign-ins, directory audits, identity risk, security alerts, licences. | Data that already lives in the customer’s Microsoft tenant. Mahoney reads it and stores the security-relevant subset in the database above. | The customer’s own Microsoft tenant region |
| Microsoft Azure Key Vault | Envelope encryption keys for helpdesk ticket content (not yet enabled). | Encryption keys only — never ticket content itself. | The region of the configured vault |
| Resend | Transactional e-mail — invitations, notifications, contract links. | Recipient name and e-mail address, and the content of the message sent. | United States |
| Stripe | Subscription billing, usage metering, and partner payouts (Connect). | Billing contact, subscription and usage records. Card data never reaches Mahoney. For a partner payout account: the partner admin's e-mail address, the partner's country and our partner id, sent when the account is created — the identity and bank details behind it the partner gives Stripe directly. | United States |
| PayPal | Alternative payment method for subscriptions. | Billing contact and subscription records. Card data never reaches Mahoney. | United States |
| Intuit QuickBooks | Accounting export and payment onboarding, where the operator connects it. | Invoice and customer billing records. | United States |
| Google Maps Platform | Address autocomplete and distance calculation on site records. | The address text typed into an address field. | United States |
Data a customer’s own systems hold — their Microsoft tenant, their RMM, their EDR — stays with those systems; Mahoney reads the security-relevant subset and stores it in the database named above. See the privacy policy for what is collected, why, and how long it is kept.
