AuditBull — Sub-processor List
What is a Sub-processor?
Magnataur Consulting, LLC ("Magnataur", "we", "us") operates AuditBull (the "Service"), a multi-tenant Governance, Risk & Compliance (GRC) SaaS platform. When a Customer subscribes to the Service, Magnataur acts as a Processor of that Customer's data, and the Customer acts as the Controller.
A Sub-processor is a third-party service provider that Magnataur engages to Process Customer Data (including Personal Data) on our behalf in order to deliver the Service. Each Sub-processor is bound by contractual data-protection obligations consistent with our Data Processing Agreement ("DPA") with the Customer.
This list identifies the Sub-processors Magnataur uses to provide the Service. We keep this list current and update it when a Sub-processor is added, removed, or changed.
Current Sub-processors
| Sub-processor | Purpose / service provided | Categories of data processed | Location |
|---|---|---|---|
| Microsoft Corporation | Azure cloud hosting (compute, PostgreSQL database, Key Vault); Microsoft Entra ID (Customer SSO / authentication); Microsoft Teams & Bot Framework (product distribution + chat interface); Microsoft Graph (directory reads). | Customer Data at rest (all tenant records: systems, risks, vendors, access reviews, compliance workflows, audit trail); authentication identifiers and directory attributes (names, email addresses, org/tenant identifiers); secrets and configuration. | United States (Azure US-East region) |
| Cloudflare, Inc. | Edge network: DNS, CDN, Web Application Firewall (WAF), Zero Trust Access, and tunnel to origin. | Network/transport metadata (IP addresses, request headers, TLS handshake data) for traffic in transit; no Customer Data at rest. | United States |
| Stripe, Inc. | Payment processing and subscription billing. | Customer billing-account and subscription data; payment-method and transaction data (handled by Stripe as the payment processor). | United States |
| Clerk, Inc. | Authentication / identity provider for Google and email sign-in. | Authentication identifiers (email addresses, federated sign-in identifiers, session data). AuditBull does not store Customer passwords. | United States |
| Anthropic, PBC | AI-assisted features (e.g., the assessment engine), invoked only if/when a Customer enables and uses an AI feature. | Only the Customer Data submitted to an AI feature at the time it is used (e.g., assessment prompts and the relevant GRC records for that request). Not invoked when AI features are disabled. | United States |
Notes:
- All Sub-processors listed above are United States–based, and the Service is hosted exclusively in the United States (Azure US-East) at launch. No EU or APAC data residency is offered at this time.
- Anthropic, PBC is engaged only if/when AI features are enabled by a Customer. The AI substrate is newly shipping; Customers who do not use AI features do not have Customer Data Processed by Anthropic.
Change-Notification Commitment
Consistent with the DPA, Magnataur will provide Customers with advance notice before engaging a new Sub-processor or replacing an existing one, and will provide a mechanism to object to the change.
- Advance-notice window: thirty (30) days' advance notice before the new Sub-processor begins Processing Customer Data .
- If a Customer has a reasonable, good-faith objection to a new Sub-processor on data-protection grounds, the Customer may raise the objection through the mechanism described below, and the parties will work in good faith to resolve it as set out in the DPA. If the parties cannot resolve the objection, the Customer may terminate the affected Service .
Staying Informed of Updates
Customers can subscribe to updates to this Sub-processor List. When a Sub-processor is added, removed, or changed, Magnataur will provide notice by email to the Customer's designated administrative contact, and this page will be updated to reflect the change .
Last updated: 2026-07-18