Legal

Data Processing & Sub-processors

Last updated: 1 June 2026

⚠ Draft for review. This is a summary. A full Data Processing Addendum (with Standard Contractual Clauses and security schedule) must be finalised with legal counsel, and the sub-processor entries confirmed, before being offered to customers.

When FINSIMUL processes data on a customer's behalf, the customer is the data controller and FINSIMUL is the data processor. This page summarises how we process customer data and lists the sub-processors we use. It is offered alongside a full Data Processing Addendum (DPA) available to customers on request.

1. Scope of processing

  • Subject matter: provision of the FINSIMUL cost-intelligence service.
  • Nature & purpose: ingesting, normalising, analysing and reporting on cloud and SaaS cost and usage data.
  • Types of data: cloud billing and usage records; authorised user account details (name, work email, role).
  • Duration: for the term of the subscription and any agreed retention period.

2. Our obligations

We process customer data only on documented instructions, ensure personnel are bound by confidentiality, apply appropriate technical and organisational security measures (see our Security page), assist with data-subject requests and breach notification, and delete or return data at the end of the engagement, all as set out in the full DPA.

3. International transfers

Where data is transferred outside the UK/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses and, where relevant, the UK International Data Transfer Addendum.

4. Sub-processors

We engage the following sub-processors to deliver the service. We remain responsible for their compliance and will give customers notice of material changes.

  • Amazon Web Services (AWS) — cloud hosting and infrastructure. Region: Asia Pacific (Sydney), ap-southeast-2.
  • Anthropic — AI model provider used to generate report analysis and recommendations from cost-data slices and customer-supplied context.
  • Google — authentication (OAuth sign-in) for portal access. [Confirm scope before publishing.]

[Confirm this list is complete and accurate — add any email, error-monitoring or analytics providers in use before publishing.]

5. Requesting the DPA

To request our full Data Processing Addendum, contact privacy@finsimul.com.