bifrost sub-processor list

Overview

This page lists the sub-processors bifrost engages to Process Customer Data, and potential end-user data where applicable, when providing our customers with the bifrost services.

Definitions

Bifrost is instructed to Process the following categories of data subjects and data on behalf of the Customer:

System User: Individuals authorized by the Customer to access and use BIFROST's administration tools, including the Customer's employees, contractors, and designated personnel from Business Partners.
Technical Data: Workload metadata (regarding the Customer's deployed services and software designated for analysis with Bifrost):
Pod specifications (podspecs)
Software Bills of Materials (SBOMs) corresponding to such workloads
AppArmor events generated during the AUDIT phase, covering, inter alia, syscalls, signals, and capabilities
Compute environment metadata (regarding the environment in which the bifrost agent runs):
Kubernetes version
Linux distribution/flavor

Website

Last updated: 11 April 2023

Sub-processor company	Head-quarter location	Server location, where is Personal Data processed?	Purpose of the processing	Categories of Personal Data processed	Categories of Data Subject	Retention period
HubSpot Ireland Limited	Dublin, Ireland	Frankfurt, Germany	Website form submissions (Contact us and Newsletter)	Name, Email, Company Name	Website visitors	Until opt-out

bifrost portal (.com)

Last updated: 15 August 2023

Sub-processor company	Head-quarter location	Server location, where is Personal Data processed?	Purpose of the processing	Categories of Personal Data processed	Categories of Data Subject	Retention period
Amazon Web Services EMEA SARL, B186284	Luxembourg	Frankfurt, Germany	Compute, analysis & storage	System User: Identification Data, Login & Access Data, System Metadata, Device Data Technical Data: Workload metadata (podspecs, SBOMs, AppArmor AUDIT events) and compute environment metadata (Kubernetes version, Linux distribution/flavor)	System User	System User: Customer controlled, max thirty (30) days after account deletion Technical Data: Matching contract period of Main Agreement, Technical Data is deleted after forty-five (45) days

bifrost portal (.se)

Last updated: 31 August 2026

Sub-processor company	Head-quarter location	Server location, where is Personal Data processed?	Purpose of the processing	Categories of Personal Data processed	Categories of Data Subject	Retention period
evroc AB, 559398-0930	Stockholm, Sweden	Sweden	Compute, analysis & storage	System User: Identification Data, Login & Access Data, System Metadata, Device Data Technical Data: Workload metadata (podspecs, SBOMs, AppArmor AUDIT events) and compute environment metadata (Kubernetes version, Linux distribution/flavor)	System User	System User: Customer controlled, max thirty (30) days after account deletion Technical Data: Matching contract period of Main Agreement, Technical Data is deleted after forty-five (45) days

Subscribe to changes

Get an email when we add, remove, or change a sub-processor on this list.