Legal
Subprocessors
The third-party providers Herd Security engages to deliver the Services, what each one does, and the data it processes.
Updated: October 12, 2026
Herd Security, Inc. engages the subprocessors below to provide the Services. Each is bound by a written agreement requiring confidentiality and security measures no less protective than our own commitments to Customers, and each processes personal data only on our documented instructions. This page is the authoritative list; our Privacy Policy references it rather than repeating it.
Infrastructure
Hosting and core platform services. These providers process all Customer Data held by the Services.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services | Primary cloud infrastructure: compute, databases, object storage, queueing, authentication, and transactional email delivery. | All Customer Data processed by the Services. | United States |
AI and machine learning
Model providers used to generate training content, simulation templates, and assistant responses. Customer Data is never used to train these providers' models.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Anthropic | Model inference for AI-generated training content, simulation templates, and the in-product assistant. | Prompt content submitted to AI features and the output generated from it. | United States |
| OpenAI | Model inference, image generation, text embeddings, and speech synthesis for training content. | Prompt content submitted to AI features and the output generated from it. | United States |
| Google Cloud Platform | Model inference, image generation, and video generation for AI-generated content, with transient storage of rendered video that is deleted within 24 hours. | Prompt content submitted to AI features and the output generated from it. | United States |
| xAI | Model inference for AI-generated content. | Prompt content submitted to AI features and the output generated from it. | United States |
| ElevenLabs | Voice synthesis for narrated training content and voice simulations. | Script text submitted for narration. | United States |
| HeyGen | Avatar video generation for training content. | Script text submitted for narration and any presenter likeness a Customer administrator chooses to upload. | United States |
Simulation delivery
Carriers for simulations that reach employees by phone. Each receives data only when a Customer runs the corresponding simulation type. A Customer that runs only email simulations has no data processed by any of them.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| TextLink | SMS delivery for smishing simulations and SMS training reminders. | Employee phone numbers and the content of messages Herd sends and receives. | United States |
| Telnyx | Outbound call placement and in-call speech transcription for voice phishing simulations. | Employee phone numbers, call audio, and transcripts of what the employee says during the simulated call. | United States |
| Meta Platforms | WhatsApp Business Platform message delivery for WhatsApp simulations. | Employee phone numbers and the content of messages Herd sends and receives. | United States |
Customer integrations
These providers receive data only when a Customer connects the corresponding integration, and only to the extent that integration requires. A Customer that does not connect an integration has no data processed by the provider behind it.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Slack | Delivery of training, simulations, and policy attestations through the Herd Slack app, for Customers who connect Slack. | Employee identifiers and the content of messages Herd sends and receives. | United States |
| Microsoft Azure | Directory synchronization and Microsoft Teams delivery, for Customers who connect Microsoft Entra ID or Teams. | Employee directory records and the content of messages Herd sends and receives. | United States |
| Okta | Directory synchronization and single sign-on, for Customers who connect Okta. | Employee directory records and authentication events. | United States |
| Google Workspace | Directory synchronization and security alert ingestion, for Customers who connect Google Workspace. | Employee directory records and security alerts. | United States |
| GitHub | Pull request and commit metadata for engineering risk signals, for Customers who install the Herd GitHub App. | Repository, pull request, and commit metadata, including author identities. | United States |
| BambooHR, Rippling, and Workday | Directory synchronization from a human resources system, for Customers who connect one. | Employee directory records. | United States |
Business operations
Providers supporting billing and signup. These process contact and billing details of Customer administrators and signup visitors, not end-user training data.
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe | Subscription billing and payment processing. | Billing contact details and payment information. | United States |
| Cloudflare | Bot protection on the self-service signup form. | IP address and browser signals of visitors who submit the signup form. | United States |
Data location
All subprocessors listed above process data in the United States. Herd Security hosts the Services in the United States and does not replicate Customer Data outside that region.
Changes to this list
We update this page when we engage a new subprocessor or replace an existing one. Customers with an executed Data Processing Agreement receive notice of changes in accordance with the terms of that agreement, including any right to object it grants.