Legal
Sub-processors
The third parties that process customer data on behalf of ArenOrg AS.
This list is a working draft.
It has not been reviewed by a lawyer, and the company identifiers below are placeholders. It is published so that a buyer's procurement process can see exactly what the product does and what we are prepared to commit to — every factual statement about the system was checked against the code. Do not treat it as a signed agreement. For the executable version, email contact@arenorg.com.
What each supplier does here was established by reading the code, so the purpose and data columns are accurate. Most locations, and whether an agreement is signed, are commercial facts that have not been confirmed, and those cells say so rather than guessing — a sub-processor list is read as a statement of fact, and a wrong processing location is a transfer problem rather than a typo. A cell shown in green is settled: the agreement is executed, or the location is one the application itself fixes. Error reports are addressed to Sentry's European endpoint, so that data cannot leave the EU without the address changing — which is a change to this codebase, not a supplier's decision.
| Supplier | What it does | Personal data it sees | Location | Agreement |
|---|---|---|---|---|
| Vercel | Runs the application and serves every request; counts visits to the public website (Web Analytics). | All workspace data in transit while a request is handled. For the public website only: the page opened (without its query string), the referring site, country and device type — no cookies, nothing stored on the visitor's device, and never inside a customer's workspace. | European Union (Frankfurt, fra1) | To be confirmed |
| Neon | The application database. | All structured workspace data: people, documents, competence, audits, findings, risks, visitors. | European Union (Frankfurt, eu-central-1) | To be confirmed |
| Cloudflare R2 | Holds uploaded documents, competence certificates and audit evidence. | Files as uploaded, including certificates naming individuals. | European Union (EU jurisdiction) | To be confirmed |
| Resend | Sends transactional email — invitations, password resets, notifications. | Recipient name and email address, and the message body. | To be confirmed | To be confirmed |
| Sentry | Reports application errors so they can be fixed. | Error context, which can include the URL, the signed-in user's id and request parameters. Only for visitors who allow statistics cookies, a sample of session replays: a recording of the screen with all text, form inputs and images masked before it leaves the browser. | European Union | Signed 27 Sep 2026 |
| Anthropic | Powers the AI assistant, document drafting and course generation (Claude models), for workspaces with AI switched on. | The text of whatever a user asks about or asks to be written, which may quote documents and name individuals. | United States | To be confirmed |
| SMS provider | Sends visitor sign-out links and host arrival alerts. | A visitor's mobile number, and the visitor's name and employer inside the host's alert. | To be confirmed | To be confirmed |
Transfers out of the EEA
Where a supplier is settled above, the basis is stated here rather than left to be asked for. Sentry's data processing addendum (version 5.1.0) incorporates the Standard Contractual Clauses approved by the European Commission in decision 2021/914, and the workspace is pinned to Sentry's European data region.
Sentry is also the only row currently settled on both counts. For every supplier whose cells are still amber, treat the transfer question as open and ask — we would rather be asked than have a blank read as an assurance.
The AI provider, specifically
The product states that AI is scoped to your workspace and never shared across tenants. That is true of this application: a request carries only the workspace it came from, and nothing crosses between customers.
It is a statement about our behaviour, not the upstream provider's. The provider is Anthropic, used through its commercial API on our own account. How long Anthropic retains prompts, and the transfer mechanism for processing in the United States, are governed by Anthropic's commercial terms and data processing addendum; the confirmed details will be stated here. Until then, ask.
A workspace can turn AI features off entirely. If your assessment is that no content may leave our own sub-processors, that is the setting to use.
Asking for a supplier's audit reports
Where a supplier publishes certifications — SOC 2, ISO 27001, penetration test summaries — we obtain and keep them, and we will share what we are permitted to share with a customer under a confidentiality agreement.
They are not republished here. Those reports are released to us in confidence, and a supplier's audit report is not ours to put on the open web. A sub-processor page that links one has usually not read the terms it was given under. Where a supplier name above is a link, it points to that supplier's own public security page, so you can check the claim at its source rather than take ours for it.
To request what we hold, email contact@arenorg.com and say which supplier you are assessing.
When this list changes
We will publish a change here before a new sub-processor starts processing customer data, and we will email the administrators of affected workspaces. If you object to a new sub-processor, the data processing agreement sets out what happens next.
To be told about changes in writing, email contact@arenorg.com and ask to be added to the notification list.