Hardenwell GRC

Subprocessors

Last updated: October 19, 2026

Hardenwell GRC is owned and operated by Hardenwell Cybersecurity Advisors LLC. To run the Service at https://app.hardenwell.com, we use a small number of service providers ("subprocessors") that store or process information on our behalf. Each one works under a contract that limits what it may do with the information to providing its service to us. This page lists them; our Privacy Policy explains what information the Service collects and why.

Current subprocessors

Hosting and infrastructure

  • Provider: Amazon Web Services, Inc.
  • What it does: runs the Service — the application servers, the database, uploaded files, backups and logs.
  • Information involved: everything stored in the Service: account information and workspace content.
  • Location: the United States.

Email delivery — Resend, Inc.

  • What it does: delivers the emails the Service sends — sign-in and confirmation links, security notices, invitations, reminders, task and sign-off links, digests and scheduled reports.
  • Information involved: each recipient's name and email address, and the email's subject and content (which can include names of people and tasks at a client, and a report attached as a PDF when a workspace schedules one). When a workspace sends client email from its own domain, that domain name.
  • Location: the United States.

Artificial intelligence — Anthropic, PBC

  • What it does: produces the responses for the Service's AI features (the assistant, document and evidence reading, suggested answers, drafting, vendor and questionnaire help, and the other features listed under "AI features" in our Privacy Policy).
  • Information involved: only the workspace content needed for the feature someone uses, for example the document being read or a summary of a client's program. Documents flagged as appearing to contain patient information are not sent. Our provider may not use this content to train its models.
  • When: only when AI features are used. Workspace administrators can turn AI features off, in whole or feature by feature; with AI off, nothing is sent.
  • Location: the United States.

Payments — Stripe, Inc.

  • What it does: takes payment for paid plans and manages subscriptions.
  • Information involved: the workspace's billing contact, plan and payment details. Card numbers go straight to Stripe and never reach our servers. Stripe never receives client records.
  • Location: the United States.

Services that are not subprocessors

These receive requests from the Service only because a workspace or a person chooses to use them. They are not our subprocessors, and their own terms apply.

  • Tools a workspace connects for a client (for example Microsoft 365, Google Workspace, endpoint protection, backup or HR systems) receive the read requests described in our Privacy Policy, using access the client's administrator approves.
  • A workspace's own ticketing tool, webhooks, and Slack or Microsoft Teams channels receive what the workspace sets up to send them.
  • Google and Microsoft sign-in, when a person chooses "Continue with Google" or "Continue with Microsoft", and a workspace's own single sign-on provider.
  • Public sources the Service downloads or looks up without sending any client data or personal information: the HHS-OIG exclusion list and SAM.gov exclusions (names are compared inside the Service), CISA's catalog of known exploited vulnerabilities, and the public DNS records and HTTPS settings of vendors' website domains.

Changes to this list

We will update this page before a new subprocessor starts processing workspace content, and change the date at the top. Questions about this list: admin@hardenwell.com