Data Sharing and Subprocessors

Customer organisations control workspace membership, roles and project access. Data may be visible to authorised owners, administrators, staff, finance users, clients and shared-report recipients according to those settings and the actions users take. Customers are responsible for granting appropriate access and reviewing recipients before sharing.

• Application hosting, database and media storage: operate APIs, store workspace records and hold uploaded documents and media.
• Queue and delivery infrastructure: process background jobs, notifications and operational workflows.
• Email and communications: deliver verification, invitation, notification, receipt and support messages.
• Authentication: support optional external sign-in and identity verification selected by the user.
• Payment processing: create approved checkout sessions, process charges and refunds, and return transaction status and provider references.
• AI and document processing: process authorised prompts, documents or images to return extractions and suggestions for human review.
• Security, support and professional advice: help protect, troubleshoot and lawfully operate the service under appropriate duties.

Providers should receive only the data reasonably needed for their service and act under applicable contracts, confidentiality duties and security requirements. The data involved depends on which NIYAM feature a customer or user invokes.

AI inputs are sent to an AI or document-processing provider only when an authorised feature requires that processing. Output is returned to NIYAM for review and workflow use. See the AI Data Use Notice for user responsibilities and human oversight.

NIYAM may disclose data where required by valid legal process or where reasonably necessary to protect users, investigate abuse, enforce terms or respond to a security incident. If the service or operating business is reorganised, relevant data may transfer subject to appropriate confidentiality, notice and applicable law.

Service providers may process data from locations configured for the production service. NIYAM must apply any notices, contractual measures or other safeguards required for cross-border processing and respect restrictions imposed by applicable law.

Material changes to providers that process customer personal data will be communicated through an appropriate service, account or contact channel when required by applicable terms or law.