Legal
Subprocessors
Last updated: 31st October 2026
Phana (PHANA AB, "we", "us") engages a limited set of third-party companies ("subprocessors") to process customer data on our behalf as part of delivering Phana Velocity. Each subprocessor is bound by contractual data-protection obligations consistent with applicable law. All customer data is processed within Amazon Web Services (AWS) only — AWS is our sole data-plane subprocessor. The rows below describe, at a purpose level, how AWS processes customer data when operating the platform.
Current Subprocessors
The following third parties may process customer data on our behalf. Each is bound by contractual obligations to protect it.
| Subprocessor | Purpose | Data Touched | Processing Location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, compute, and encrypted storage of customer data. | Customer-uploaded compliance data, documents, evidence, and assessment metadata. | Customer's selected region. |
| Amazon Web Services, Inc. | Managed AI/LLM inference powering compliance assessment and evidence features. Customer data is NOT used to train foundation models. | Compliance content submitted for AI assessment. | Customer's selected region. |
| Amazon Web Services, Inc. | User authentication and identity management. | User account identifiers and email addresses. | Customer's selected region. |
| Amazon Web Services, Inc. | Transactional email (account provisioning and notifications). | Recipient email addresses. | Customer's selected region. |
Customer-connected data sources (the customer's own systems that Phana reads evidence from) are integrations, not Phana subprocessors, and are not listed above.
Data Residency
Phana offers regional hosting, with infrastructure in each region we offer. A customer's data is stored and processed in the customer's selected region and remains within that region. The following regions are available:
Europe
AvailableUnited States
AvailableIndia
AvailableMiddle East
AvailableTransparency & Changes
We publish this directory so customers can always see who processes their data.