Skip to content
INSIGHTSbyPROVENANCE
Book a demo

Website privacy & cookies

No optional analytics or advertising is configured in this website application. There is no optional tracking preference to save. Dismissing the notice only hides it until this page reloads; closing this panel does not give consent to anything.

Our source and public-response check is limited. Hosting logs, security challenges, enquiry handling and retention still need confirmation. The information pages are review-needed, not a complete approved privacy or cookie policy.

You can browse without an enquiry. The demo form explains whether it opens a mail draft or submits to a configured endpoint, and includes a clear-fields control. These website choices do not change consent on customer websites using INSIGHTS.

Website privacy informationCookies and choices

INSIGHTS closed operational beta

Subprocessor Register

Version beta-1 · Effective/offered 18 August 2026

This register is presented with the Processor Terms before installation. Installing or directing installation of the property-specific tag accepts general authorisation for this exact version.

Supplier/servicePurposeConfigured locationDPA
Cloudflare — Workers, KV and QueuesCollection edge, exact-origin configuration and separate operational/security queuesGlobal edge; dedicated beta resourcesProvider DPA
Cloudflare — private R2 recovery bucketEncrypted PostgreSQL/OpenBao recovery retention; no plaintext database or recovery keysDedicated EU-jurisdiction bucketProvider DPA
Render — services, PostgreSQL and persistent diskRuntime services, control/audit database and OpenBao hostFrankfurt; protected, network-isolated beta environmentProvider DPA
ClickHouse CloudOperational aggregates and physically separated security/model storesAWS Frankfurt; one replicaProvider DPA
ClerkAdministrator authentication, organisation membership and sessionsProvider-managed service; global support access may applyProvider DPA
VercelDashboard hosting, server functions and evidence downloadProvider edge and configured project functions; global support access may applyProvider DPA
Microsoft Azure — Key VaultRSA wrapping operations used to unseal the dedicated beta OpenBao instanceGermany West CentralProvider DPA

Data and recovery boundary

Operational suppliers receive only the data needed for their stated role. The operational lane retains aggregates rather than visitor or session rows. The separated security lane may process full IP address and bounded request metadata, which expire within seven days. The R2 recovery bucket contains only encrypted recovery artefacts, redacted reports and checksums.

ClickHouse external backup retention does not exist in the closed beta; recovery is provider-managed only. No consented-lane, modelling or partner-OAuth processing is authorised by this register.

Changes and objections

PROVENANCE365 will provide at least 30 days’ notice before adding or replacing an in-scope supplier, except for a documented emergency security change. A Controller may object on reasonable data-protection grounds. If the objection cannot be resolved, either party may terminate the affected INSIGHTS processing and the property will be suspended and offboarded.

Contact

Questions, objections and data-protection enquiries: support@hyceangroup.com