Sub-processors
Last updated September 25, 2026
These are the third parties Interlock MDR engages to process information on our customers' behalf. Each is bound by a written agreement to process information only on our instructions and to maintain appropriate security. We add to this list only after assessing the provider, and we give customers with a Data Processing Addendum at least 30 days' notice of a new sub-processor.
| Provider | Purpose | Information processed | Location |
|---|---|---|---|
| Microsoft Azure | Application hosting, PostgreSQL database, secrets (Key Vault), container images, static site hosting. | All platform metadata described in the Privacy Policy; transferred business data in memory only, during a transfer. | United States (East US 2) |
| Azure Communication Services (Microsoft) | Sending transactional email — verification, password reset, invitations, notifications, invoices. | Recipient email address, name, and the content of the notification. | United States |
| Google Firebase Authentication | User identity: sign-in, password storage and reset, email verification. | Email address, password (never visible to MDR), sign-in metadata. | United States |
| Stripe | Payment method collection and storage, invoicing and charging. | Company billing contact, payment details (held by Stripe only), invoice amounts. | United States |
| Anthropic | Hot Sauce AI — product design and field-mapping suggestions. Used only when a Company enables AI features. | Schema names and types; row counts or a bounded sample of records only at the access level the Company sets, from sources it allows. Not used to train models. | United States |
| Cloudflare | DNS and network-edge protection for interlockmdr.com. | Request metadata (IP address, headers) in transit. | Global edge network |
What is not on this list
The business systems a Company connects to MDR — QuickBooks, Salesforce, BigQuery, or a custom API — are not our sub-processors. They are the Company's own providers; MDR reads from them on the Company's instruction, under the Company's agreement with that provider. Likewise the Partners a Company delivers data to are independent controllers of what they receive.
Changes
Customers who want to be notified of changes to this list can request it through contact; notice is also given under the Data Processing Addendum.