Skip to main content
Borg Security uses a limited set of third-party subprocessors to deliver the Odin platform, such as hosting, database, email and AI model providers. The authoritative list, with each subprocessor’s entity, location, purpose and the data it processes, is published at odin.borghq.io/legal/subprocessors. It is the list referenced in Annex B of the Data Processing Agreement.

​
Changes to subprocessors

Borg Security gives at least 10 days’ notice before engaging a new subprocessor, as set out in section 7.3 of the Data Processing Agreement:
  • Owners and Admins of your organisation receive an email describing the change and when it takes effect.
  • The subprocessor list shows the upcoming change, with its effective date, from the moment it is announced.
  • Owners and Admins also see a notice in Odin until the change takes effect.
You may object to a new subprocessor before the effective date, in writing and on reasonable grounds relating to data protection. Reply to the notice email or write to [email protected]. If no objection is received, the change is treated as accepted. Removing a subprocessor can take effect immediately. You are still told about it by email. When your organisation first signs in to Odin, an Owner must accept three agreements before using the platform:
  • Master Services Agreement (MSA): the core service terms
  • Data Processing Agreement (DPA): how Borg Security processes personal data
  • AI Services Addendum: additional terms for AI features such as PR reviews and pentests
These documents are shown during the terms of service acceptance flow on first login.