This page is the canonical, version-pinned list of every third-party we engage to deliver the platform. It is cited as Schedule A of our Data Processing Agreement and is the single source of truth for "who else touches your data".
Any change to the list — adding a new sub-processor, retiring one, or changing a region — is recorded in the change log at the bottom of this page with a new version stamp.
The following sub-processors are engaged for the platform's default deployment. Each is bound by a confidentiality and data-processing agreement (per Privacy Policy: "we sign confidentiality and data processing agreements with all third-party service providers").
| Sub-processor | Purpose | Region | Data accessed |
|---|---|---|---|
| SiteGround HostingHosting | Application hosting, MySQL database, nightly backups, web-server access logs | Your contracted region (Sydney · Singapore · Iowa · London · Frankfurt · Eemshaven) | All in-scope data |
| Let’s Encrypt / ISRGTLS | TLS certificate issuance for HTTPS | Global certificate authority | None — public-key validation only |
| SMTP relay (hosting provider)Email | Transactional email delivery (respondent invitations, password resets, admin notifications, scheduled reports) | Your contracted region | Recipient email address + email body |
| Zoho Books / Zoho BillingBilling | Subscription billing, invoicing | Per-tenant Zoho data residency | Your billing contact name + email only — no respondent data, no response data |
| Google Workspace (TGF internal)Support | Internal email, support ticket management for designated client contacts | The Good Foundry’s own region | Names + email addresses of designated client contacts only |
| Backblaze (B2)Backup | Encrypted off-site backup — nightly database snapshot and per-response archive, retained on a daily / weekly / monthly cascade | Australia | Full database snapshot (all in-scope data). Encrypted at rest; restore access limited to The Good Foundry. |
| StripePayments | Card payment processing for paid items, Micro-Learn seat and Library purchases, and licence renewals | Stripe global (AU / US entities per billing region) | Purchaser name + email, amount and currency. Card details go directly to Stripe and never reach our servers. |
| MyMemory (Translated srl)Translation | Translates interface and evaluation text when a respondent chooses a language other than English | European Union (Italy) | Interface labels and question text only. Nothing a respondent has typed or answered. |
| Google (Translate)Translation / Voice | Second translation provider when the first is unavailable, and the read-aloud voice on devices with no local voice for the chosen language | United States | Interface labels and question text only, and the same text where it is read aloud. Nothing a respondent has typed or answered. |
Any sub-processor underpinning an optional contracted Power-Up (e.g. AI Seeding, Let’s Talk, Coaching & Leadership Videos, NotebookLM coaching summaries) is not in the default scope. It is engaged only when that Power-Up is explicitly contracted, with the third party named and the data flow documented in writing under the contract.
| Sub-processor | Power-Up it underpins | Region | Data accessed |
|---|---|---|---|
| Anthropic (Claude API)AI | AI Seeding (written explanations and coaching content), Ask Sophie’s coaching responses, the Let’s Talk conversational assistant in the respondent vault and the client-administrator bank, and the conversational answers on the Let’s Talk telephone line | United States | Respondent surfaces: that respondent’s own scores and their own free-text reflections, sent verbatim so the answer can address what they wrote. No name, no email address. Client-administrator surfaces: whole-cohort figures only, with a minimum-response floor applied before anything is sent; no individual answers, no free text, no identifiers and no breakdown by team or role. Conversation transcripts are stored by us, not by Anthropic. Anthropic does not train on this data. |
| ElevenLabsVoice | Let’s Talk by telephone: converts the caller’s speech to text and speaks the assistant’s replies. The line is only reachable with a code the person generates from their own account. | United States | The audio of the call and its transcription, and the text of the assistant’s replies. The caller’s name and email address are not sent. A written transcript is stored by us in the person’s own record. ElevenLabs does not train on this data. |
| TwilioTelephony | Let’s Talk by telephone: carries the inbound call to our published number and connects it to the speech provider above | Australia | Calling number, call time and duration, and the call audio in transit. No wellbeing data and no account identifier. |
| LiveAvatar (HeyGen)Video | Let’s Talk on-screen presenter: a live video and audio session while the conversation is open | United States | The words the presenter is to speak, which are the assistant’s replies, not the reader’s messages. The reader’s microphone is muted at source and no microphone audio is sent. |
| ZoomBooking | Coaching Foundry: appointment scheduling on a client’s practitioner booking page, through each practitioner’s own connected Zoom account | Set by the practitioner’s own Zoom account | Whatever the visitor enters into Zoom’s own booking form, which never reaches our servers. For a connected practitioner, read access to the list of their Zoom schedulers, as described in section 14 of our Privacy Policy. |
| HeyGenVideo | Coaching & Leadership Videos (personalised coaching videos and cohort leadership videos produced by our team) | United States | Persona-level segmented scores + leadership name (where included in the briefing script) |
| Google (NotebookLM)Coaching | NotebookLM Coaching Foundry — generates a deep-dive notebook + audio briefing from aggregate cohort data | Per-tenant Google Workspace residency | Aggregate cohort outputs (PDF / Markdown); no individual respondent data |
| Google (Health / Fitbit)Wearables | Wellbeing Wearables — participant-initiated device connection (steps, resting heart rate, HRV, sleep) | Per-tenant Google residency | Read-only daily metrics for participants who explicitly connect a device. We never write to the device. Disconnecting revokes the token and deletes every stored row. |
| Google (Gemini API)AI | Wellbeing infographic generation — cohort snapshots, and individual snapshots where a platform administrator generates one | United States | Cohort mode: aggregate scores and dimension averages only. Individual mode: the participant’s name and their PERMA+ scores, sent as the image prompt. Triggered only by a platform administrator, never automatically, and never by a client administrator. |
Every published change to the list appears here. The change log is append-only; superseded entries are retained for audit.
| Version | Date | Change |
|---|---|---|
| v1.2 | 6 Oct 2026 | Corrected the Anthropic row, which understated what it receives: a respondent’s own free-text reflections are sent with their scores, and Anthropic also powers Let’s Talk. Added MyMemory and Google Translate (translation and read-aloud) to default scope, and ElevenLabs, Twilio and LiveAvatar (Let’s Talk) and Zoom (Coaching Foundry booking) to Power-Up scope. Published alongside the new Artificial Intelligence section of our Privacy Policy. |
| v1.1 | 13 Sep 2026 | Added Backblaze B2 (encrypted off-site backup, Australia) and Stripe (card payments) to default scope, and Google Health / Fitbit (Wellbeing Wearables, opt-in) and Google Gemini (wellbeing infographic generation) to Power-Up scope. These were live sub-processors omitted from v1.0 — no change to processing, only to disclosure. |
| v1.0 | 26 May 2026 | Initial publication. Promoted from Technical FAQ §7 into a dedicated, versioned page so the DPA can cite a stable URL as Schedule A. Default scope: SiteGround, Let's Encrypt, SMTP relay, Zoho, Google Workspace. Power-Up scope: Anthropic, HeyGen, Google NotebookLM (opt-in only). |
Forward this URL to your data-protection or InfoSec partner. For a signed deployment-specific copy with your contracted region and any opt-in Power-Ups annotated, request it alongside our standard DPA — both ship together under mutual NDA.