Last updated: August 2026 · Org Warden Ltd
| Sub-processor | What it holds for us | Region | Company location |
|---|---|---|---|
| Vercel Inc. | Runs the Console application. Packs pass through it in transit during upload and download; it stores none. | London (lhr1) | United States |
| Neon Inc. | The database: the pack index (org and field names, findings, hashes), what you author in the Console, and account and audit records. | AWS eu-west-2, London | United States |
| Amazon Web Services EMEA SARL | Stored Evidence Pack bytes (S3, server-side encrypted, public access blocked) and one-time sign-in email (SES). | eu-west-2, London | Luxembourg (Amazon.com, Inc. group, United States) |
What is not on this list
No analytics, error-tracking, session-recording or AI service runs inside the Console. If one is ever added, it is added here first and customers are given 30 days’ notice.
Jurisdiction
All three providers are US-headquartered and operate UK regions. UK residency answers where the data is; it does not exempt a US provider from US legal process (the CLOUD Act). Ourprivacy policy, section 7, states our position. In short: the data at stake is metadata about your Salesforce configuration and never customer records; it is erasable on request; and if your policy requires a UK-owned storage chain, tell us before you upload.
Questions: dpo@orgwarden.co.uk.