A short list,
and what each category can see.

When a customer uses DenwaysHR, that customer is the controller of its employee data and Denways Technologies LLP is the processor. A sub-processor is a third party we engage that may, in the course of providing something to us, process that same data on the customer's behalf.

The distinction that matters is not whether a supplier is important to us, but whether personal data can pass through it. Our accountant and our office landlord are suppliers; neither is a sub-processor. A hosting provider that stores the database is.

We keep this page so that a customer's legal or security review can see the picture without having to send a questionnaire first, and so that a change is something we announce rather than something you discover.

We could run our own data centre, write our own mail transport and build our own denial-of-service protection. Doing so would make DenwaysHR less secure, not more. Specialised providers operating at scale patch faster, detect attacks earlier and hold certifications that a company of our size cannot realistically maintain across every layer.

So the honest position is that a small number of well-chosen sub-processors raises the security floor rather than lowering it. What we owe you in return is to keep the list short, to know exactly what each one can reach, and to say so plainly.

Every category below exists because removing it would degrade the service or its security. We do not engage a sub-processor for convenience where the data can stay inside our own boundary.

These are the categories of sub-processor engaged for the DenwaysHR production platform. Each is described by function rather than by vendor name, for the reason set out in the note at the foot of this page.

Access is scoped to what the function actually requires. The list below states the realistic upper bound of what each category could reach, not an aspiration.

Every sub-processor is engaged under a written contract that imposes data protection obligations no less protective than those in our own agreement with the customer. We remain fully liable to the customer for a sub-processor's performance; pointing at a supplier is not a defence we would accept from someone else and not one we would offer.

Before engagement, a provider is assessed on the security controls it can evidence, its independent certifications and audit reports, where it processes and stores data, its breach notification commitments, its own use of onward sub-processors, and whether it can be exited without the service being rebuilt from scratch.

Sub-processors may process data outside the country in which a customer operates. Where that happens we rely on appropriate contractual safeguards with each provider and limit them to the purposes we set, as described in the data processing agreement.

Customers with a data residency requirement should raise it before signing rather than after. We would rather tell you plainly which regions we can and cannot commit to than agree to a residency guarantee we would have to walk back later.

The regions in use for a given customer's environment are confirmed on onboarding and recorded in the executed agreement.

Customers give general authorisation for the categories above when they enter the data processing agreement. Adding or replacing a sub-processor is then a notified change, not a silent one.

We notify account administrators at least thirty days before a new sub-processor begins processing customer data, naming the provider, the function, what it will be able to reach and where it will process. Where a change is forced on us at shorter notice, for example by a provider withdrawing a service, we tell you as soon as we know and explain why the window is shorter.

Replacing a provider within an existing category is notified in the same way. A change of vendor is a change even when the function stays the same.

A customer may object to a new sub-processor on reasonable data protection grounds within the notice window, by writing to info@denways.com and setting out the grounds.

We will work with you in good faith to resolve it, which may mean additional contractual safeguards, a configuration that keeps your data out of the provider's path, or an alternative provider where one exists. Most objections we would expect to be resolvable this way.

Where an objection genuinely cannot be resolved, the customer may terminate the affected part of the service without penalty, with a pro-rata refund of fees paid for the unused period. We would rather that outcome than have a customer stay on terms it does not accept.

Account administrators receive sub-processor notices automatically at the address held on the account. No action is needed to receive them, but the address does need to be right, so check it on the account settings page.

Anyone else who needs the notices, typically a data protection officer, a security team or a procurement contact who is not an administrator, can be added to the notification list by emailing info@denways.com with the addresses to include. Prospective customers under evaluation can be added on the same basis.

Notices are also reflected on this page, and the date at the top always shows when it last changed. If you want to watch the page rather than take email, that works too.

Questions about sub-processors, and requests for the contractual and security evidence behind a given category, go to info@denways.com. Security questions go to info@denways.com.

If your review needs vendor names, certifications and processing regions in a formal document rather than a web page, ask and we will provide the current list under the confidentiality terms of your agreement.