1. Core infrastructure
These providers are used for every workspace and cannot be disabled.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Lovable (Lovable Labs Inc.) | Application hosting, build and delivery of the MAST GRC Platform | All customer data processed by the Platform | EU / US regions, global edge delivery |
| Supabase Inc. | Managed PostgreSQL database, authentication and object storage for evidence and documents | Account data, GRC records, uploaded evidence, audit logs | Region selected for the workspace (AWS) |
| Amazon Web Services | Underlying compute, storage and encrypted backups for the managed database | All customer data at rest | Region selected for the workspace |
| Cloudflare, Inc. | Edge runtime, CDN, DNS, TLS termination and DDoS protection | Request metadata, IP addresses, transient request bodies | Global edge network |
2. Communications
Used to deliver transactional messages the Platform generates. Workspace administrators control which notification types are sent from Settings → Notifications.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Mailgun (Sinch Email) | Transactional email delivery — invitations, policy and audit reminders, rollout and training notifications | Recipient name and email address, message content, delivery events | EU / US sending regions; sending domain notify.mastgt.com |
3. Optional, customer-enabled
These providers only process data if the workspace explicitly enables the corresponding feature or connects the account.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Lovable AI Gateway (and its model providers) | AI-assisted drafting, summarisation and control mapping — only when a workspace enables AI features | Prompt content submitted by the user; no training on customer data | EU / US |
| Google LLC — Google Drive | Evidence import when a workspace connects Google Drive | Files and metadata the customer selects | Per the customer's own Google tenancy |
| Microsoft Corporation — OneDrive / SharePoint | Evidence import when a workspace connects Microsoft 365 | Files and metadata the customer selects | Per the customer's own Microsoft tenancy |
| Dropbox, Inc. | Evidence import when a workspace connects Dropbox | Files and metadata the customer selects | Per the customer's own Dropbox account |
4. MAST affiliates
MAST Consulting Group entities may access customer data to provide support and contracted advisory services, under the same confidentiality and security obligations described in the DPA. Support access is role-restricted, logged, and available for review in the workspace activity log.
5. Change notifications
MAST publishes changes to this list here and gives at least 30 days' notice before a new sub-processor starts processing customer personal data. To subscribe to notifications, or to object to a change on reasonable data protection grounds, email privacy@mastcgroup.com.