Subprocessors
Subprocessor Directory — ZeroTrust
Version: 2026-10-01 · Effective: October 1, 2026
To deliver ZeroTrust, Entrinsia Inc. ("Entrinsia," "we," "us," or "our") engages third-party infrastructure and service providers ("Subprocessors") to process End User personal data on behalf of our Business Customers (Data Controllers).
This page lists our active Subprocessors, the category of data each provider handles, the processing location, and how we govern these relationships.
1. Active Subprocessors
| Subprocessor | Purpose & Processing Function | Categories of Personal Data Handled | Primary Processing Location | Transfer Mechanism / Safeguards |
|---|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure, compute, document OCR/authentication, facial liveness detection, and biometric comparison | Raw ID images (transient/in-memory only), video selfies (transient/in-memory only), biometric confidence signals, extracted text fields, and encrypted compliance logs | United States (US-East / US-West regions) | EU Standard Contractual Clauses (SCCs), UK IDTA, AWS GDPR Data Processing Addendum |
2. Subprocessor Safeguards & Obligations
Every Subprocessor engaged by Entrinsia is vetted under our vendor security management program and bound by a written Data Processing Agreement (DPA) enforcing strict contractual protections:
- Strict Purpose Limitation: Subprocessors are contractually authorized to process End User data solely to deliver the verification service requested by Entrinsia and our Business Customers.
- No AI Model Training: Subprocessors are strictly prohibited from retaining, archiving, or using End User ID images, video selfies, biometric comparisons, or extracted personal data to train or improve their own machine learning models or algorithms.
- Ephemeral Data Handling: Cloud processing providers process ID images, video selfies, and biometric comparisons in-memory and in-transit only. Media is never written to persistent disk, databases, or backup storage.
- Confidentiality & Access Control: Subprocessor personnel are bound by statutory or contractual obligations of confidentiality, with logical access restricted under least-privilege role-based access control (RBAC).
- Security Standards: Subprocessors must maintain industry-recognized security attestations (such as SOC 2 Type II and ISO/IEC 27001 certification) and implement technical safeguards including TLS encryption in transit and AES-256 encryption at rest.
3. Subprocessor Change Notification & Objection Rights
Entrinsia maintains a 30-day advance notice policy for any proposed addition or replacement of a Subprocessor that handles End User personal data.
How to Receive Notifications
Business Customers can subscribe to automated Subprocessor update alerts by emailing support@entrinsia.com with the subject line "Subprocessor Notification Subscription".
Right to Object
In accordance with Section 16 of our Terms of Service and Section 6 of our Data Processing Addendum:
- Business Customers will receive notification at least thirty (30) days prior to the engagement of any new Subprocessor.
- A Customer may object to a new Subprocessor on reasonable data protection or security grounds by submitting a written objection to support@entrinsia.com within the 30-day notice period.
- If Entrinsia cannot reasonably accommodate or provide an alternative processing workflow, the Customer may terminate the affected portion of the Service without penalty and receive a pro-rata refund of any prepaid, unused fees.
4. Revision History
Every published version of this document remains permanently archived.
| Version | Effective Date | Summary of Changes |
|---|---|---|
2026-10-01 | October 1, 2026 | Initial publication of the ZeroTrust Subprocessor Directory. |