S

SoSafe SE

Provides security awareness training, phishing simulations, AI chatbot, and human risk management solutions for organizations.

vendor	purpose	evidence
A Amplitude	Internal website analytics	“Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.” source
A Ashby USA	Manage recruitment and hiring process	“We use Ashby, Inc., a cloud services provider located in the United States of America to help manage our recruitment and hiring process as a processor on our behalf.” source
C Clari Sunnyvale, CA 94086, USA	Meeting recordings	“We use the service provider Clari CoPilot, which is operated by Clari, Inc, 1154 Sonora Court, Sunnyvale, CA 94086, USA to record the meetings, to take notes during the meeting, to summarize the meeting and to train employees. We have concluded a data processing agreement with Clari, which obliges Clari to protect your data and to process it on our behalf in accordance with this privacy policy. Your personal data will be transferred to the servers of Clari in the USA. Clari is an active participant in the EU – U.S. Data Privacy Framework which means it has reliable mechanisms in place for personal data transfers from the European Union to the United States. On top of this we have concluded the standard contractual clauses adopted by the European Commission with Clari in order to ensure the level of data protection of the GDPR in the USA as well.” source
C Cloudflare, Inc	CDN and security services including DDoS protection and traffic optimization	“To ensure the security and performance of our website, we use the services of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). As a Content Delivery Network (CDN) and security provider, Cloudflare acts as an intermediary for our website traffic. This means the access data listed above (in particular your IP address and technical log information) is automatically transmitted to and processed by Cloudflare to detect and avert cyber-attacks (e.g., DDoS protection) and to optimize loading times. We have concluded a Data Processing Agreement (DPA) with Cloudflare in accordance with Art. 28 GDPR.” source
G G2	User session tracking for marketing analytics	“Tracks the individual sessions on the website, allowing the website to compile statistical data from multiple visits.” source
G Google EU	Feedback forms	“In addition, we may add links to feedback forms in connection with our Phishing Report Button. These feedback forms are provided by Google, our processor, on servers in the EU. Data will be only transmitted if you add and submit data in these forms. We solely use such data for the purposes mentioned in the respective feedback form.” source
G Google Ireland Limited Ireland	Providing Google Workspace services including communication and online meetings	“Google acts as a data processor on our behalf and processes personal data in accordance with applicable data protection laws and contractual safeguards, including EU Standard Contractual Clauses where applicable.” source
H HubSpot Ireland	Send newsletters	“To send our newsletter, we use the service provider HubSpot, which is operated by HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland. We have concluded a data processing agreement with HubPpot, which obliges HubSpot to protect your data, to process it on our behalf in accordance with this privacy policy and not to pass it on to third parties.” source
L Leadfeeder	Account-based marketing analytics	“Used in context with Account-Based-Marketing (ABM). The cookie registers data such as IP-addresses, time spent on the website and page requests for the visit.” source
M Meta Platforms, Inc.	Cross-website advertisement targeting	“This cookie is used by Facebook to target advertisement based on user behavior and preferences across multiple websites.” source
M Metaview United Kingdom	Record interviews and generate interview notes	“With the applicant’s consent, we may use Metaview, a recruitment support tool based in the United Kingdom, to record interviews and generate interview notes. This data is processed exclusively for recruitment purposes, based on consent, and handled by Metaview as a data processor in accordance with applicable data protection laws.” source
M Microsoft	Website analytics and user behavior tracking	“Collects data on the user’s navigation and behavior on the website. This is used to compile statistical reports and heatmaps for the website owner.” source
O OpenAI Ireland Ltd Ireland	Generating phishing attack scripts using personal data	“ChatGPT (provided by OpenAI Ireland Ltd, Ireland) generates a phishing attack script.” source
R Reddit	Targeted advertising across websites	“Used to track visitors on multiple websites, in order to present relevant advertisement based on the visitor's preferences.” source
S SendGrid Denver, CO 80202, USA	Demo mail dispatch	“For sending the demo mails as part of our demo (at demo.sosafe.de), but not for our phishing simulations as part of a commission, we use the services of SendGrid, Inc, 1801 California Street, Suite 500, Denver, CO 80202, USA. Cookies and web beacons (tracking pixels) are used within the emails sent by SendGrid when performing the demo mailing. With the help of SendGrid, we analyse the sending of the demo emails. The analysis is used exclusively for the statistical analysis of the messages as well as for the preparation of the evaluation of the demo mail dispatch. The personal data is transferred to the SendGrid server in the USA. Government agencies in the USA may also have access to this personal data. We have concluded the standard contractual clauses adopted by the European Commission with SendGrid in order to ensure the level of data protection of the GDPR in the USA as well.” source
T talque Berlin, Germany	Webinar management	“We use the networking platform talque, Real Life Interaction GmbH, Choriner Str. 3, 10119 Berlin, to conduct the webinar. Only if you have decided to participate in the webinar will we pass on the data generated during registration to talque. You will then receive an email with a personal invitation link. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b) GDPR. The processing of the data by talque takes place on the basis of a concluded order processing contract in accordance with Art. 28 GDPR.” source
T Twilio Ireland Limited Ireland	Initiating automated calls for simulated attacks	“Twilio Ireland Limited, Ireland, uses the voice imitation to initiate an automated call to the phone number associated with your LinkedIn profile.” source
V Vimeo	Website visit tracking	“Collects data on the user's visits to the website, such as which pages have been read.” source

• A

  Amplitude

  Internal website analytics

  “Registers statistical data on users' behaviour on the website. Used for internal analytics by the website operator.” source

• A

  Ashby

  USA

  Manage recruitment and hiring process

  “We use Ashby, Inc., a cloud services provider located in the United States of America to help manage our recruitment and hiring process as a processor on our behalf.” source

• C

  Clari

  Sunnyvale, CA 94086, USA

  Meeting recordings

  “We use the service provider Clari CoPilot, which is operated by Clari, Inc, 1154 Sonora Court, Sunnyvale, CA 94086, USA to record the meetings, to take notes during the meeting, to summarize the meeting and to train employees. We have concluded a data processing agreement with Clari, which obliges Clari to protect your data and to process it on our behalf in accordance with this privacy policy. Your personal data will be transferred to the servers of Clari in the USA. Clari is an active participant in the EU – U.S. Data Privacy Framework which means it has reliable mechanisms in place for personal data transfers from the European Union to the United States. On top of this we have concluded the standard contractual clauses adopted by the European Commission with Clari in order to ensure the level of data protection of the GDPR in the USA as well.” source

• C

  Cloudflare, Inc

  CDN and security services including DDoS protection and traffic optimization

  “To ensure the security and performance of our website, we use the services of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). As a Content Delivery Network (CDN) and security provider, Cloudflare acts as an intermediary for our website traffic. This means the access data listed above (in particular your IP address and technical log information) is automatically transmitted to and processed by Cloudflare to detect and avert cyber-attacks (e.g., DDoS protection) and to optimize loading times. We have concluded a Data Processing Agreement (DPA) with Cloudflare in accordance with Art. 28 GDPR.” source

• G

  G2

  User session tracking for marketing analytics

  “Tracks the individual sessions on the website, allowing the website to compile statistical data from multiple visits.” source

• G

  Google

  EU

  Feedback forms

  “In addition, we may add links to feedback forms in connection with our Phishing Report Button. These feedback forms are provided by Google, our processor, on servers in the EU. Data will be only transmitted if you add and submit data in these forms. We solely use such data for the purposes mentioned in the respective feedback form.” source

• G

  Google Ireland Limited

  Ireland

  Providing Google Workspace services including communication and online meetings

  “Google acts as a data processor on our behalf and processes personal data in accordance with applicable data protection laws and contractual safeguards, including EU Standard Contractual Clauses where applicable.” source

• H

  HubSpot

  Ireland

  Send newsletters

  “To send our newsletter, we use the service provider HubSpot, which is operated by HubSpot, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland. We have concluded a data processing agreement with HubPpot, which obliges HubSpot to protect your data, to process it on our behalf in accordance with this privacy policy and not to pass it on to third parties.” source

• L

  Leadfeeder

  Account-based marketing analytics

  “Used in context with Account-Based-Marketing (ABM). The cookie registers data such as IP-addresses, time spent on the website and page requests for the visit.” source

• M

  Meta Platforms, Inc.

  Cross-website advertisement targeting

  “This cookie is used by Facebook to target advertisement based on user behavior and preferences across multiple websites.” source

• M

  Metaview

  United Kingdom

  Record interviews and generate interview notes

  “With the applicant’s consent, we may use Metaview, a recruitment support tool based in the United Kingdom, to record interviews and generate interview notes. This data is processed exclusively for recruitment purposes, based on consent, and handled by Metaview as a data processor in accordance with applicable data protection laws.” source

• M

  Microsoft

  Website analytics and user behavior tracking

  “Collects data on the user’s navigation and behavior on the website. This is used to compile statistical reports and heatmaps for the website owner.” source

• O

  OpenAI Ireland Ltd

  Ireland

  Generating phishing attack scripts using personal data

  “ChatGPT (provided by OpenAI Ireland Ltd, Ireland) generates a phishing attack script.” source

• R

  Reddit

  Targeted advertising across websites

  “Used to track visitors on multiple websites, in order to present relevant advertisement based on the visitor's preferences.” source

• S

  SendGrid

  Denver, CO 80202, USA

  Demo mail dispatch

  “For sending the demo mails as part of our demo (at demo.sosafe.de), but not for our phishing simulations as part of a commission, we use the services of SendGrid, Inc, 1801 California Street, Suite 500, Denver, CO 80202, USA. Cookies and web beacons (tracking pixels) are used within the emails sent by SendGrid when performing the demo mailing. With the help of SendGrid, we analyse the sending of the demo emails. The analysis is used exclusively for the statistical analysis of the messages as well as for the preparation of the evaluation of the demo mail dispatch. The personal data is transferred to the SendGrid server in the USA. Government agencies in the USA may also have access to this personal data. We have concluded the standard contractual clauses adopted by the European Commission with SendGrid in order to ensure the level of data protection of the GDPR in the USA as well.” source

• T

  talque

  Berlin, Germany

  Webinar management

  “We use the networking platform talque, Real Life Interaction GmbH, Choriner Str. 3, 10119 Berlin, to conduct the webinar. Only if you have decided to participate in the webinar will we pass on the data generated during registration to talque. You will then receive an email with a personal invitation link. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b) GDPR. The processing of the data by talque takes place on the basis of a concluded order processing contract in accordance with Art. 28 GDPR.” source

• T

  Twilio Ireland Limited

  Ireland

  Initiating automated calls for simulated attacks

  “Twilio Ireland Limited, Ireland, uses the voice imitation to initiate an automated call to the phone number associated with your LinkedIn profile.” source

• V

  Vimeo

  Website visit tracking

  “Collects data on the user's visits to the website, such as which pages have been read.” source