Service Provider Schedule
Important: The final schedule depends on the systems and processing routes used for a specific customer. It is completed before attachment to the applicable DPA.
Auditbahn subprocessors
A provider is listed as an Auditbahn subprocessor when Lucido LLC engages it to process customer personal data for the managed service. The engagement schedule records the provider, purpose, data categories, processing locations, transfer mechanism, and the engagements in which it is used.
Hetzner is the default infrastructure provider for Auditbahn-controlled systems, with Falkenstein, Germany as the default location. Other available locations may be selected on documented customer request, including locations outside the EEA. The selected location and applicable transfer safeguards are recorded for the engagement.
Customer-selected systems
These providers ordinarily operate under the customer’s own agreement. Auditbahn personnel may use them through customer-issued access, but that use does not by itself make the provider an Auditbahn subprocessor.
- GRC platforms: Controls, evidence, policies, risks, and audit workflows.
- Identity providers: Authentication and access administration.
- Ticketing systems: Remediation and task tracking.
- Document and communication systems: Evidence, policies, meetings, and communications.
- Customer-selected AI providers: Customer-authorised assistance under the customer’s provider agreement.
Auditbahn-controlled tooling
When Auditbahn-controlled tooling processes customer personal data, the infrastructure providers actually used for that processing must be included in the engagement schedule.
Bring-your-own AI is planned. Until it is implemented and verified, the provider and transfer route actually used must be documented instead of being described as bring-your-own.
Website and sales providers
Providers used only for auditbahn.com analytics, contact handling, advertising measurement, scheduling, or general sales operations are controller-side providers. They are described in the Privacy Policy and do not become customer-data subprocessors unless an engagement data flow makes them one.
Request the applicable schedule
Contact [email protected] for the schedule relevant to a proposed or active engagement. International transfers are addressed in the Data Transfer Addendum.