Legal
Subprocessor Register
The third parties that may process customer data in the course of delivering our services.
Last updated: 2026-09-25 · Version 1.1
About this page
Fenrir Security Limited (Fenrir) engages a small number of third parties to help deliver our services. This page lists the subprocessors that may process customer data in the course of that delivery. It is referred to in our Master Services Agreement and applies to all customers unless their agreement states otherwise.
A subprocessor is a third party we engage to process customer data on our behalf. Customer data means any data, including personal information, that a customer discloses to us, or that we collect, access, generate or derive, while providing our services.
This register covers third parties that process customer data as part of delivering our services. It does not cover our own business administration systems, such as finance and time recording, which hold commercial records that identify customers but do not process customer security data.
Where a customer's security telemetry is held within the customer's own Microsoft tenant, Microsoft acts as the customer's processor rather than ours. The subprocessors listed below are the third parties that process customer data within Fenrir's own systems and tooling.
Current subprocessors
Subprocessor | Processing activity | Categories of data | Location of processing |
|---|---|---|---|
Microsoft 365 (Exchange, SharePoint, Teams) | Secure storage, collaboration and communication used to operate and deliver our managed service | Incident records, reports and communications, including any personal information contained within them | Australia (the Microsoft 365 region serving New Zealand tenants) |
Microsoft Azure | Cloud platform and AI services operated by Fenrir to deliver the managed service | Security telemetry and incident data processed by Fenrir-operated Azure resources, including any personal information contained within them | Primarily New Zealand (New Zealand North). Some workloads are processed in Australia (Australia East) and, where required for specific services such as AI processing, in other Microsoft Azure regions including the United States or European Union |
Atlassian (Jira and Confluence) | Security incident and service request ticketing, and operational documentation | Incident and service request records, including any personal information contained within security event data | Global: data residency not pinned; in-scope data is stored across Atlassian's global AWS regions and may be moved between regions |
GitHub (GitHub Enterprise Cloud) | Source control and CI/CD pipelines for infrastructure-as-code and internal applications used to deploy and operate our services | Customer environment and configuration details contained in infrastructure-as-code and deployment configuration, including tenant and resource identifiers and security configuration values | Australia (GitHub Enterprise Cloud data residency) |
Anthropic (Claude) | AI-assisted analysis, drafting and summarisation across all of our services, including investigation, triage and reporting in managed detection and response | Customer information provided or generated during an engagement, including security telemetry, incident data, environment and configuration details, and any personal information contained within it | United States |
Have I Been Pwned (Superlative Enterprises Pty Ltd) | Credential and account exposure checks against email addresses | Email addresses of customer staff and users, which are personal information, queried to identify exposure in known data breaches | Australia and United States (operated from Australia; hosted on Microsoft Azure and Cloudflare, see HIBP sub-processor list) |
Shodan | External attack surface and exposure monitoring | Customer public IP addresses and domain names (public-facing asset identifiers; not personal information) | United States |
Terms and safeguards
Each subprocessor is engaged under commercial terms appropriate to the service it provides. In particular:
Customer data disclosed to a subprocessor is used only to deliver our services and is not sold.
Where a subprocessor provides AI services, that processing is performed under terms that prohibit the use of customer data to train the provider's models.
Where a subprocessor processes customer data outside New Zealand, we require that it protects that data in a manner providing comparable safeguards to those required under the Privacy Act 2020.
Provider terms and security information:
Microsoft: Data Protection Addendum · Trust Center
Atlassian: Data Processing Addendum · Trust Center
GitHub: Data Protection Agreement · Trust Center
Anthropic: Commercial Terms of Service, which incorporate the Data Processing Addendum · Trust Center
Have I Been Pwned: Data Processing Addendum · Privacy Policy
Shodan: Terms of Service · Privacy Policy
Threat intelligence and enrichment sources
During investigation and threat hunting we query external threat intelligence and enrichment services. These are queried with third-party indicators such as external IP addresses, domains and file hashes observed during an investigation. Because these indicators are not the customer's own data, and we do not disclose customer data to these services, they are not subprocessors, but we list them here for transparency.
Spur: IP address context and anonymisation detection, using external IP addresses observed during an investigation.
Changes to this register
We may add or replace subprocessors from time to time. When we do, we update this page and, where a change affects the processing of customer data, we give affected customers at least 30 days' notice by email to their nominated contact. Customers may object to a new or replacement subprocessor on reasonable data protection grounds as set out in their agreement.
You do not need to subscribe; notifications are sent to your nominated contact automatically. To confirm or update your nominated contact, or to ask about any change, contact your Fenrir account manager or email privacy@fenrir.nz.
Questions
For any questions about this register or how we handle your data, contact privacy@fenrir.nz.