Paperwork, already half done

DPIA starter: Harmonic Security

from trust card 2 answers · you answer 7 left

1. What personal data does the tool process, and where?
   you answer
2. Where does processing happen?
   from trust card · maker says AWS in the EU or US. The sub-processor list says processing stays in your region by default; EU hosting is available on request.
3. Who else receives the data (sub-processors)?
   from trust card · maker says AWS (hosting), Auth0 / Okta (sign-in), ClickHouse (database), Sentry (error logs; customer data excluded by default), Kombo (HR system link), HubSpot (CRM, EU), Pendo (usage analytics, EU; you can opt out).
4. How long is it kept?
   you answer
5. The supplier’s role under UK GDPR
   you answer
6. Why do you need this processing?
   you answer
7. Who are the data subjects?
   you answer
8. Main risks, and what reduces them
   you answer
9. Residual risk after controls
   you answer