Sub-processors

Purpose: hosting, deployment and application delivery.

Data may include website and application request metadata, application runtime data and deployment logs needed to operate the service.

Purpose: DNS, SSL, CDN and security layer.

Data may include request metadata, IP addresses and security-related traffic information used to route and protect the service.

Purpose: database, authentication and file storage.

Data may include organisation records, user accounts, staff records, training records, assessments, appraisal records, CPD records, development action records, registration or check details, evidence metadata and uploaded evidence files.

Purpose: payments, subscriptions, invoices and billing portal services.

SkillProof stores Stripe customer, subscription and billing status identifiers. Card details are handled by Stripe and are not stored directly by SkillProof.

Purpose: delivery of account, security and operational emails from SkillProof.

Data may include recipient email addresses, message subjects, operational message content and delivery metadata needed to send and troubleshoot those emails. Any future marketing email would require an appropriate permission and suppression process.

Purpose: delivery of public website trial, demo and partner enquiry forms.

Data may include the contact details and enquiry information submitted through those forms.

Purpose: optional public-website analytics after a visitor accepts analytics. SkillProof sends sanitised first-party events from its server. If marketing measurement is also accepted, the Google browser tag sends limited public-page measurements.

Data may include a hashed or pseudonymous visit identifier, page path, allowlisted campaign information, device category and website interaction events. SkillProof does not send public form contents, raw query strings or customer workspace data to Google Analytics.

Purpose: optional campaign and successful-trial measurement after a visitor accepts marketing measurement.

Data may include advertising click identifiers and limited page-view or successful-trial destination data. SkillProof configures ad personalisation as denied and does not send form contents, names, email addresses, telephone numbers or customer workspace data through the Google tag.

Purpose: optional public-website behaviour analytics after a visitor accepts analytics.

Data may include masked page interactions, device and browser information used for session recordings, heatmaps and website usability analysis. SkillProof masks the public page body and does not load the public Clarity integration on private customer application routes.

SkillProof may update this list as providers change or new operational services are added.

Customers with contractual notification requirements should contact the privacy team through the SkillProof Contact page.