Infrastructure that holds your data
Swipe sideways to see every column
| Provider | What it does | What it processes | Location |
|---|---|---|---|
| MongoDB Atlas (MongoDB, Inc.) | Managed database hosting. Every organisation has its own database on the cluster. | All structured data an organisation records: members, records, attendance, leave, projects, notes, pay, and the encrypted ciphertext of Vault items. | Cluster hosted on cloud infrastructure; region set per cluster. Dedicated regional clusters on the Enterprise plan. |
| Amazon Web Services — EC2 | Runs the application servers and the API gateway. | All data in transit through the platform while a request is served. | Asia Pacific (Mumbai), ap-south-1. |
| Amazon Web Services — S3 and CloudFront | Object storage for files, documents, CVs, screen recordings, screenshots and payslips, served through signed URLs. | The files themselves, under a prefix per organisation. | Asia Pacific (Mumbai), ap-south-1, with CloudFront edge caching for delivery. |
Services that handle data in passing
Swipe sideways to see every column
| Provider | What it does | What it processes | Location |
|---|---|---|---|
| CloudAMQP (84codes AB) | Managed RabbitMQ message broker between the gateway and the services. | Request payloads while a message is in flight; nothing is retained once processed. | Hosted on cloud infrastructure in the region the broker is provisioned in. |
| Resend (Resend, Inc.) | Sends transactional email: invitations, notifications, payslips, contact-form messages. | Recipient name and email address, the message content, and any attachment such as a payslip PDF. | United States. |
| OpenAI (OpenAI, L.L.C.) | Reads and summarises a CV for the résumé-parsing and AI-screening features in HRMS — only when an organisation uses them. | The text of the submitted CV and the job description it is matched against. Sent over the API, which OpenAI does not use for training. | United States. |
On this website only
Swipe sideways to see every column
| Provider | What it does | What it processes | Location |
|---|---|---|---|
| Google Tag Manager and Google Analytics (Google LLC) | Aggregate analytics on the marketing pages, when enabled in production and, where required, after consent. | Pages viewed, referrer, device and browser type, approximate location. Never anything from inside a signed-in organisation. | Global. |
What is not on this list
- No advertising networks, data brokers or resellers. We do not sell or share data for marketing.
- No third-party support desk or CRM holding your organisation’s data. Support is a mailbox read by the team.
- No third-party document viewer. Documents open in the browser’s own renderer; a private file is never sent to an external viewer.
- Not the AI assistants your members connect through Orbiz MCP, such as Claude or ChatGPT. Their providers receive only what a member asks their own assistant to read, under that member’s or your organisation’s own agreement with the provider. We do not engage them, so they are not our sub-processors.
Changes to this list are announced to administrators by email at least 30 days in advance. Questions go to orbiz-support@innovation-insight.com.