Sub Processor List
Last updated: July 1, 2026
These are the third parties we use to process personal data when providing the Service. We give customers at least 30 days notice before adding or changing a sub processor.
Questions?hello@secondframe.co
001
Core Infrastructure and Platform
- Google Cloud Platform (Google LLC). Purpose: cloud hosting, compute, database, and storage. Data: all categories of platform data. Location: United States or your selected region.
- Temporal (self hosted or Temporal Cloud). Purpose: workflow orchestration for live simulations. Data: assessment session identifiers and state. Location: your selected region.
002
AI and Assessment
- OpenRouter, Inc. Purpose: routing of AI model requests and inference. Data: assessment prompts and interaction content. Location: United States.
- AI model providers reached via OpenRouter. Purpose: generating actor responses and evaluation outputs. Data: assessment prompts and interaction content. Location: varies by model provider.
- Customer configured AI provider (BYOK). Purpose: inference using the Organization's own API key. Data: assessment prompts and interaction content. Location: set by the Organization.
Under Bring Your Own Key (BYOK), the Organization selects and contracts with its own AI provider, and that provider processes data under the Organization's arrangement, outside Secondframe's control.
003
Payments
- Paddle.com Market Ltd. Purpose: payment processing and merchant of record. Data: buyer name, email, billing and transaction data. Location: United Kingdom and United States.
004
Communications
- Postmark (Wildbit / ActiveCampaign). Purpose: transactional email delivery, such as invites and notifications. Data: recipient name and email, message content. Location: United States.
005
Authentication
- Google (Google LLC). Purpose: sign in with Google (OAuth). Data: account identifier and basic profile shared at sign in. Location: United States.
- LinkedIn (LinkedIn Corporation). Purpose: sign in with LinkedIn (OAuth). Data: account identifier and basic profile shared at sign in. Location: United States.
006
Changes and Contact
We give Organizations at least 30 days notice before adding or replacing a sub processor, as set out in our Data Processing Addendum. For questions about this list, contact hello@secondframe.co.
Questions about our sub processors?
We respond within one business day.