Sub-processors
ASE (All Seeing Eye) maintains this list of sub-processors involved in the delivery of its autonomous AI pentesting services. All sub-processors listed below are bound by data processing agreements with security obligations equivalent to ASE's own commitments.
Current sub-processors
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Akamai Cloud (Linode) | Dedicated compute infrastructure for client assessment instances | United States / EU | Assessment data, target data |
Data access restrictions
No sub-processor has access to target credentials. Credentials and PII discovered during assessments are automatically redacted before any data reaches sub-processor infrastructure. All assessment data processed by sub-processors is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3).
Sub-processor onboarding
Each sub-processor undergoes a security assessment before onboarding. This assessment evaluates the sub-processor's security posture, data handling practices, compliance certifications, and incident response capabilities. Only sub-processors that meet ASE's security requirements are approved for use.
Change notification policy
- Changes to this sub-processor list are communicated to all affected clients at least 30 days in advance of the change taking effect.
- Clients may object to a new sub-processor within 15 days of receiving the notification.
- If a client raises a reasonable objection, ASE will work with the client to find an alternative arrangement or, where not possible, allow the client to terminate the affected services without penalty.
- Emergency replacements (for example, due to a security incident at a sub-processor) may be made with shorter notice, with immediate notification to affected clients.
Contractual safeguards
All sub-processors are contractually required to:
- Process data only for the purposes specified by ASE and in accordance with ASE's documented instructions
- Implement appropriate technical and organizational security measures
- Notify ASE without undue delay of any data breach or security incident
- Delete or return all personal data upon termination of the sub-processing agreement
- Make available all information necessary to demonstrate compliance with data protection obligations
- Submit to audits and inspections by ASE or its designated auditor
Contact
For questions about ASE's sub-processors, data processing practices, or to request notification of sub-processor changes, contact security@ase.run.