Annex 3: List of Holistics sub-processors
This is a part of our Data Processing Agreement (DPA).
Last updated: 13 June 2026
"Sub-Processors for Customer Database" refers to the service providers that are used by Holistics as described in the DPA (https://docs.holistics.io/legal/dpa).
Customer Database Sub-processors
These sub-processors host or process data from the Customer's connected database.
No duplicate warehouse of the Customer Database. Holistics is not a data warehouse and does not create a separate, persistent copy of the physical data records in the Customer Database. The sub-processors below provide the hosting and compute infrastructure through which Holistics queries the Customer Database on demand to serve the Subscription Services. As an intermediary processor, Holistics retains only transient artefacts: (a) Temporary Cached Query Results, which hold the records returned by a query for the limited, Customer-configurable period described in Annex 1 (minimum 10 minutes) before they automatically expire; and (b) exported files (Excel/CSV), retained for up to 24 hours. Outside these transient artefacts, the physical data records residing in the Customer Database are not stored or warehoused by Holistics.
| Sub-processor | Entity Country | Location of Servers | Purpose |
|---|---|---|---|
| Amazon Web Services, Inc. | USA | USA, Germany, Singapore | Amazon S3, RDS and/or other AWS services |
| DigitalOcean, Inc. | USA | USA, Germany, Singapore | Infrastructure hosting |
| Mailgun, Inc. (Sinch) | USA | USA, EU | Transactional emails, scheduled email reports, and data alerts |
Service-Specific Sub-processors
These sub-processors process data to provide specific features within the Services.
| Sub-processor | Entity Country | Purpose |
|---|---|---|
| Cloudflare, Inc. | USA | Content delivery, network performance optimization, security, abuse prevention, and DNS |
| OpenAI, Inc. | USA | LLM provider for AI-powered features |
Usage and Metadata Sub-processors
These sub-processors process Holistics metadata and usage data for internal analytics. They do not process the content of the Customer's connected database. This data is retained only as long as needed for these purposes, in accordance with the Holistics data retention policy (https://docs.holistics.io/docs/security-compliance/data-retention) and, as stated in Annex 1, is removed within 180 days after the Term ends, or earlier upon the Customer's request to the Holistics support team.
| Sub-processor | Entity Country | Purpose |
|---|---|---|
| Google, Inc. | USA | Google Cloud Platform (GCP), BigQuery |
| Anthropic, PBC | USA | LLM provider for data analytics |
| OpenAI, Inc. | USA | LLM provider for data analytics |
| GitHub, Inc. | USA | Source control hosting for AMQL/analytics definitions and logic |
AI sub-processor data protections
For the customer-facing AI-powered features, Holistics uses its own key with OpenAI by default, and OpenAI acts as a Holistics sub-processor for those features. Holistics configures the processing so that the provider:
- does not use Customer Data to train or improve its models;
- operates under zero or minimal data retention, so that Customer Data is not retained by the provider after the response is returned; and
- does not log the content of API requests, where the provider offers that control.
These configurations form part of the data protection terms Holistics imposes on its sub-processors under the "Customer Database Sub-Processors" section of the DPA. The specific provider settings reflect each provider's current capabilities and may change as providers update their offerings; where a setting changes, Holistics will maintain protections that are materially equivalent. The current configuration and the controls available to the Customer are described at https://docs.holistics.io/docs/ai/data-access-and-policy.
LLM provider keys (bring-your-own-key)
Where the Customer uses the bring-your-own-key (BYOK) option and supplies its own LLM provider API key (for example, an OpenAI or Anthropic key), the Customer engages that provider directly under the Customer's own account and agreement, and that provider is not a Holistics sub-processor for the processing performed under the Customer's key.
| Signature: Name: (completed on signing) Designation: (completed on signing) Holistics Software Pte Ltd Date: (completed on signing) | Signature: Customer Name: (completed on signing) Designation: (completed on signing) Company: (completed on signing) Date: (completed on signing) |