This Subprocessor List (“List”) identifies the subprocessors that Applied Systems, Inc. and its affiliates (collectively “Applied”) has engaged to process personal data for the Applied products, services, and other purposes as listed below. In addition to the below subprocessors, Applied’s affiliates support and maintain Applied products and services. In selecting its subprocessors, Applied uses commercially reasonable processes to evaluate the security and privacy practices of potential subprocessors. Once selected, Applied requires its subprocessors to satisfy materially equivalent obligations to those Applied has agreed to in its contracts with our customers and as otherwise required by applicable laws, including but not limited to the obligation to keep information secure and confidential, process it in accordance with instructions provided, and notify Applied in the event of a security breach. Applied may change, remove, or add subprocessors to the List as our business evolves. Applied will post updates to the List here. Please check back frequently for updates.
Entity Name |
Nature & Purpose of Processing |
Location of Subprocessing Activities |
Applicable Product or Service |
|
Hosting Subprocessors |
|||
|
Amazon Web Services, Inc. |
Cloud hosting |
United States, Canada (based on customer location) |
Indio, Applied Benefits Designer, Ask Kodiak, Tarmika |
|
Google LLC |
Cloud hosting |
(1) United States (2) Netherlands |
(1) Applied Epic (US, Can) (2) Applied Epic – attachments only (UK) |
|
Microsoft Corporation |
Cloud hosting (Azure) |
(1) Canada (2) Republic of Ireland (3) Netherlands |
(1) Policy Works (2) WealthTrack (3) RiskHandler |
|
Other Subprocessing Services |
|||
|
Adyen |
Payment processing services |
United States |
Applied Pay; Applied general corporate use |
|
Applied Client Network |
Membership services within industry group for customers |
United States |
Applied general use |
|
Cloudflare, Inc. |
Internet Security Services (web application firewall, DDoS attack prevention and related security services) |
Globally at the data center closest to end user |
Applied general corporate use relating to data centers and internet gateways for products and services |
|
Datadog, Inc. |
Security log and event aggregation and tracking for cloud infrastructure |
United States |
Applied general corporate use |
|
DocuSign |
eSignature functionality |
United States |
Applied general corporate use |
|
Drift.com |
Generative artificial intelligence for chatbot text |
United States, Canada based on user location |
Applied websites |
|
Genesys |
Phone and recording services for sales and support |
United States |
Applied general corporate use (US, Canada) |
|
Auth0 (formerly Okta) |
Authentication and single-sign on provider |
United States |
Applied products with SSO enabled |
|
Opayo Ltd. (formerly Sage Pay) |
Payment processing services |
United Kingdom |
Applied Epic payments (UK) |
|
OpenAI, LLC |
Generative artificial intelligence for creating text |
United States |
EZLynx Virtual Assistant |
|
Made By Sauce Ltd. |
Website design services |
United Kingdom |
Applied Epic (UK) |
|
Mailgun Technologies, Inc. |
Communication services and email capabilities |
United States |
Applied Marketing Automation (US, Canada) |
|
Marketo |
Customer, sales lead, and marketing services and management |
United States |
Applied general corporate use |
|
ModSquad |
After-hours support for insureds |
United States |
Applied CSR24 (US) |
|
NetSuite |
Billing and accounting services |
United States |
Applied general corporate use |
|
Pendo.io, Inc. |
In-app training functionality |
United States |
Applied Epic (US) |
|
Salesforce, Inc. |
Customer relationship management |
United States |
Applied general corporate use |
|
Twilio, Inc. |
Communication services and texting capabilities
|
United States |
Applied Integrated Texting; EZLynx texting; Applied Epic |
|
Zoom, Inc. |
Customer support and general telecommunications services |
United States |
Applied general corporate use |
List last updated June 17, 2024