This website uses cookies
Read our Privacy policy and Terms of use for more information.
Last reviewed: 29 April 2026
Vistergy Ltd uses the following sub-processors to deliver its services. This list is published per UK GDPR Article 28 (controller / processor contracts must include the categories of sub-processors). Where Vistergy acts as a processor on behalf of a customer (for example, when the customer subscribes to an Agent through the IBM watsonx Orchestrate Agent Connect catalogue), the customer is the controller and Vistergy is the processor; the sub-processors below process Personal Data on Vistergy's behalf for the purposes shown.
Agent Service
Processing Customer Data on behalf of subscribers
Sub-processor
Purpose
Personal Data categories
Location
Sub-processor terms
IBM Corporation
IBM Cloud / watsonx
Hosts the watsonx Orchestrate runtime and the Granite LLM that the Vistergy agents call.
Customer queries (which may contain Customer's authorised users' identifiers); audit and lineage records.
EU / customer-region (per IBM Cloud zone selected at subscription); IBM Corporation, USA.
Cloudflare, Inc.
cloudflared tunnel
Tunnels the Vistergy Agent endpoint between Vistergy infrastructure and IBM Cloud during the IBM watsonx Orchestrate trial.
Customer queries in transit (TLS-encrypted).
Cloudflare global edge.
Vercel Inc.
Hosts atlas.vistergy.com (the public Atlas) and the architecture-diagram assets referenced from the Documentation pages. Vercel does not process Customer Data routed through the Agent.
None directly for the Agent service (incidental analytics: anonymised IP / referer for Atlas page views).
Vercel global edge.
WEBSITE, NEWSLETTER, & PODCAST
Visitor data — distinct from Customer Data
SUB-PROCESSOR
PURPOSE
PERSONAL DATA
LOCATION
TERMS
Beehiiv, Inc.
Newsletter platform (The Vistergy Brief, Still Dark) and podcast hosting (Permit to Operate); Vistergy pages hosted at vistergy.com (including this page).
Subscriber name (optional), email address, engagement data; podcast listener analytics; visitor analytics on Vistergy pages.
Beehiiv US-hosted on AWS.
Google LLC
Analytics 4
Web analytics for atlas.vistergy.com (anonymised)
Anonymised IP, referer, page-view path (analytics).
Google Cloud, US / EU.
Google LLC (YouTube)
Video hosting and distribution for the Permit to Operate podcast (@permit2operate channel); channel analytics provided to Vistergy as channel owner.
Viewer analytics (watch time, audience demographics in aggregate), commenter identifiers.
Google global.
LinkedIn (Microsoft Corporation)
Distribution and engagement for the Still Dark newsletter (dual-published on LinkedIn alongside Beehiiv); engagement analytics on Vistergy company-page posts.
LinkedIn account identifiers; engagement data (impressions, reactions, comments, shares) on Vistergy posts.
LinkedIn US / Ireland data centres.
Note on podcast distribution platforms (Apple Podcasts, Spotify, etc.). Apple Inc., Spotify AB, and other podcast directories receive Vistergy's public RSS feed for the Permit to Operate podcast. They are not Vistergy sub-processors: they have their own direct controller relationship with their users, and Vistergy receives no listener Personal Data from these platforms. Listener data on those platforms is governed by the platform's own privacy policy, not Vistergy's.
Vistergy notifies controllers of sub-processor changes through the Customer's registered support contact at least 30 days before the change takes effect. Customers may object to a new sub-processor on reasonable grounds by emailing [email protected] within 30 days of notification.
Sub-processor questions: [email protected]