S2 Group: List of Approved Sub-Processors
Last updated: 16.10.2026
Questions: Inforequest@s2partnership.co.uk
- Purpose of this document
This document lists the third-party sub-processors that we, the S2 Partnership Ltd and S2 Software Ltd (“S2 Group”, “we”, “our”, “us”), engage to process personal data on behalf of our Clients, in connection with our RiskWise software application.
This document is provided to support our obligations to our Clients under applicable data protection laws. It should be read alongside the Software Licence Agreement, Schedule 7, entered into between S2 Group and its Clients, and which sets out each party’s respective obligations under Article 28(3) UK and EU GDPR (as defined in the Software Licence Agreement).
The list is split into two parts, reflecting that sub-processor engagement differs depending on which features of RiskWise a Client uses:
- Section A: Sub-processors engaged for RiskWise. They apply to all Clients.
- Section B: Sub-processors engaged only where a Client opts to use RiskWise Insight. They apply to only those Clients who use RiskWise Insight.
A. RiskWise: Sub-processors
These sub-processors support the use of RiskWise, and apply to all Clients regardless of which features are enabled.
| Sub-processor & Country | Purpose of processing | Categories of personal data | Location of processing* | International Transfer Mechanism (as applicable) |
| Mythic Beasts, UK | Cloud hosting | Client Personal Data created by client and stored in Applicable Cloud Products, Account data, usage/log data | UK | N/A |
| Zendesk, Inc, USA | Email communications and support ticketing system | Contact Details, Client Personal Data shared or created by client and/or extracted from RiskWise | EU | UK/adequate country |
| Microsoft Corporation, USA | Client Contracts and agreement documentation, client-specific reports as part of the delivery of the service. | Contact Details, Client Personal Data shared or created by client and/or extracted from RiskWise | UK, EU | UK/adequate country |
| Microsoft Azure, USA | Cloud Hosting (Report Generation specifically) | Usage/log data | UK | N/A |
| Atlassian, USA | Technical Support, bug investigation | Contact Details, Client Personal Data shared or created by client and/or extracted from RiskWise | UK | N/A |
| DocuSign Inc., USA | To send and sign agreements securely. | Contact details | US | UK/adequate country |
| ZeroBounce, USA | Email Validation and Verification service | Contact details | US | UK/adequate country |
B. RiskWise Insight: Sub-processors
These sub-processors are engaged only where a Client uses RiskWise Insight. If a Client does not use RiskWise Insight, these sub-processors do not apply.
| Sub-processor & Country | Purpose of processing | Categories of personal data | Location of Processing* | International Transfer Mechanism (as applicable) |
| Vercel Inc, USA | AI gateway and infrastructure used to route requests to AI services | Account data, Client Personal Data created by client and stored in Applicable Cloud Products and submitted via RiskWise Insight | Global | UK/adequate country |
| Google-Gemini, USA | Generative Artificial Intelligence processing | Account data, Client Personal Data created by client and stored in Applicable Cloud Products and submitted via RiskWise Insight | EU (enforced as part of the request) | UK/adequate country |
*Where the “Location of Processing” for a sub-processor is outside of the UK and not on the UK’s adequacy regulations list, the “International Transfer Mechanism” column confirms the safeguard relied on, together with confirmation that a Transfer Risk Assessment has been completed, where required.
2. How we authorise sub-processors
In accordance with Article 28(2) UK and EU GDPR (as defined in the Software Licence Agreement), we operate on a general authorisation basis.
We will give Clients reasonable prior notice, via email to the Client Representative before we appoint a new sub-processor or replacing an existing one, so that Clients may object on a reasonable data protection grounds in accordance with the Software Licence Agreement.
However, nothing shall prevent us from immediately suspending, removing, replacing or ceasing to use any sub-processor where we reasonably consider such action necessary to:
- protect the security, confidentiality, integrity or availability of the Services or Personal Data;
- comply with applicable law, regulatory requirements or directions from a competent authority; or,
- mitigate material operational, legal, security, compliance or commercial risk.
In such circumstances, we shall notify Clients of any such change as soon as reasonably practicable thereafter.
3. How to stay informed of changes
- Check the “Last updated” date at the top of this page.
- Contact inforequest@s2partnership.co.uk with any questions or to formally object to a new or replacement sub-processor.
4. Related documents
- Corporate Licence Agreement, Schedule 7 – Data Protection
- Privacy Policy: https://support.s2riskwise.com/hc/en-gb/articles/45915477425681-Privacy-and-Cookie-Policy
Comments
0 comments
Article is closed for comments.