Duku Sub-Processor List
This page is the Sub-Processor List referred to in section 4.2 of the Duku Data Processing Addendum. It lists every third party that Duku engages to process Customer Personal Data on a customer’s behalf. Vendors that never receive Customer Personal Data, such as internal telemetry and tooling providers, are not sub-processors and are not listed.
Current sub-processors
| Sub-processor | Legal entity and address | Processing | Location | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services | Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Cloud hosting and storage for the Duku platform, including its database, object storage and test session media; AI model inference through Amazon Bedrock (Anthropic models) | Ireland (AWS eu-west-1) and, for Amazon Bedrock, the European Union. AWS does not move or replicate content outside the chosen region except as needed to provide services Duku initiates or to comply with law | Not applicable for storage, which stays in Ireland. The AWS Data Processing Addendum is incorporated into the AWS Service Terms, with EU Standard Contractual Clauses applying automatically to any transfer outside the EEA |
| Anthropic | Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (an affiliate of Anthropic, PBC, San Francisco) | AI model inference over captured test content: the URL, text and structure of the pages under test, screenshots of them, and the test steps Duku generates. Duku uses Anthropic models primarily through Amazon Bedrock (see above); the Anthropic API is a fallback | United States when the Anthropic API is used (data stored in the US; inference may be routed globally). Anthropic deletes inputs and outputs within 30 days; Duku has no zero-data-retention agreement with Anthropic | Standard Contractual Clauses with the UK Addendum, under the Anthropic Data Processing Addendum (incorporated into Anthropic’s Commercial Terms) |
| Google Cloud | Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland | Hosting and analytics of a replica of the Duku platform database (BigQuery); AI model inference over captured test content as a backup service (Vertex AI) | United Kingdom (London, europe-west2) for the platform database replica. AI model inference, as a backup service, uses Google’s global endpoint | Google Cloud Data Processing Addendum. Google LLC is certified under the EU-US Data Privacy Framework (including the UK Extension), with Standard Contractual Clauses as the fallback |
| OpenAI | OpenAI OpCo, LLC, 1455 3rd Street, San Francisco, CA 94158, United States | AI model inference over captured test content: the URL, text and structure of the pages under test, screenshots of them, and the test steps Duku generates | United States. OpenAI retains abuse-monitoring logs for up to 30 days; Duku has no zero-data-retention agreement with OpenAI | Standard Contractual Clauses with the UK Addendum, under the OpenAI Data Processing Addendum (incorporated into the OpenAI Services Agreement) |
Where you connect an integration such as GitHub or Linear, Duku sends test results and issues to that system at your direction. Those providers are your processors, not Duku’s sub-processors.
What every sub-processor has agreed
Before a sub-processor receives any Customer Personal Data, Duku confirms and keeps on file that:
- a data processing agreement is in place covering Duku’s use, with obligations substantially equivalent to Duku’s own obligations under the Data Processing Addendum;
- nothing Duku sends is used to train the provider’s models: each provider’s commercial terms exclude Duku’s inputs and outputs from model training by default;
- confidentiality obligations are consistent with Duku’s commitments to its customers; and
- an appropriate international transfer mechanism is in place wherever data leaves the EU or the UK.
Changes to this list
Section 4.2 of the Data Processing Addendum gives customers twenty (20) days to object to a proposed new sub-processor. Every change to this page is published as a new dated version: the version history shows each version, its effective date and a redline of exactly what changed. To be notified when this list changes, write to legal@duku.ai.