Skip to content
IdeaScore

Sub-processors

Version 1.0Effective 1 October 2026

This page lists the third parties that CMS Group ("IdeaScore", "we") uses to provide IdeaScore, what each one does, what personal data it handles and where. It is Annex 3 of our Data Processing Agreement and is published at /legal/subprocessors.

Each Sub-processor works under a written contract that requires it to protect the data, use it only to provide its service to us, and keep to terms at least as protective as our Data Processing Agreement. Capitalised terms have the meanings given in the Privacy Policy and the Data Processing Agreement.

Where Customer Data is held. Customer Data is stored in Mumbai, India (database) and the Asia-Pacific region (uploaded files, export files and encrypted backups), and processed in Singapore (application) and Tokyo, Japan (email). Cloudflare's network carries each request through the location nearest to the visitor, and IdeaScore AI processes the text sent to it outside India, as the table below shows.

1. Sub-processors of Customer Data

These providers may Process Customer Personal Data.

Sub-processorWhat it does for usPersonal data it handlesLocation
MongoDB, Inc. (MongoDB Atlas)Database hosting. Each organisation has its own database.All Customer Data held in the database: account, application, evaluation, communication, audit and security recordsStored in Mumbai, India
Render Services, Inc. (Render)Runs the IdeaScore application servers and background jobs.All Customer Data passing through the application while it is processed; temporary filesProcessed in Singapore
Cloudflare, Inc. (Cloudflare network, DNS and TLS)Sits in front of the Service: DNS, HTTPS, caching of static files, protection against attacks, rate limiting.All traffic to and from the Service, including IP addresses, request details and the content of pages and requests in transitCloudflare's global network, nearest to each visitor
Cloudflare, Inc. (Turnstile)The bot check on public forms (trial requests, password-reset requests, application submit and draft saves with an email, "send me my link", public voting links), when switched on.Browser and device signals read by the check, the IP address, and the check's result tokenCloudflare's global network
Cloudflare, Inc. (R2 object storage)Stores uploaded files (for example pitch decks and photos), page previews, organisation export files (deleted after 24 hours) and encrypted nightly backups.Uploaded files and their previews; export files; encrypted backups of all Customer DataStored in the Asia-Pacific region (the location we select for our storage when it is created; Cloudflare treats it as a preference, not a guarantee)
ResendDelivers the emails the Service sends: invitations, password resets, applicant sign-in links, reminders, results and other programme emails.Recipient name and email address, and the subject and body of each emailProcessed in Tokyo, Japan
Anthropic, PBC (Claude API): IdeaScore AI engineRuns the language models behind IdeaScore AI when a Customer uses it, including the web searches of Deep Research. Our main AI engine provider.The text sent for an IdeaScore AI request: form answers, pitch decks (with these details blacked out, or their text with them removed), the rubric, the Customer's instructions, tuning, memory and programme documents, and chat questions. Before anything is sent, the names of the people in the Customer's programme are replaced with labels and email addresses, phone numbers, profile links and identity numbers are removed, within the limits in the AI Use Statement. With Deep Research, the search queries the request needs. Not used to train models. The provider may keep inputs and outputs for a limited time to check for safety and misuse, as its terms allow.Outside India: Anthropic's infrastructure, including the United States. No India-only processing is offered. The Service shows each Customer that processing is outside India and asks for acceptance before the first run.
Google LLC (Gemini API): IdeaScore AI fallback engineAnswers IdeaScore AI requests that the main engine provider does not answer: when it is busy, unavailable, paused or over its usage limit, and for any part of IdeaScore AI we run on this provider alone. With Deep Research, it also runs the web searches for the requests it answers.The same as for the main engine provider, for the requests it answers.Outside India: Google's global infrastructure, including the United States. The same acceptance applies.

2. Sub-processors for Sign-in and Payments

These providers handle limited personal data, only when a Customer turns the feature on or a person chooses to use it.

Sub-processorWhat it does for usPersonal data it handlesLocation
Google LLC (Google sign-in)Lets Users sign in with a Google account, where the Customer enables it.Account identifier and verified email address returned by GoogleUnited States and Google's global infrastructure
Microsoft Corporation (Microsoft sign-in)Lets Users sign in with a Microsoft work or school account, where the Customer enables it.Account identifier and verified email address returned by MicrosoftUnited States and Microsoft's global infrastructure
Razorpay Software Private Limited (Razorpay)Takes online payments in Indian rupees, and processes refunds.Payer's name, email, phone and payment details entered on Razorpay's checkout (card and bank details are handled by Razorpay and never reach us); order amounts and referencesIndia
Stripe, Inc. and its affiliates (Stripe)Takes online payments in other currencies, and processes refunds.Payer's name, email, billing address and payment details entered on Stripe's checkout (card details are handled by Stripe and never reach us); order amounts and referencesUnited States and Stripe's global infrastructure

3. Providers for Our Own Business

These providers handle personal data that we control ourselves (for example correspondence sent to our contact addresses, including privacy requests and grievances). They do not Process Customer Data except where a Customer sends it to us in an email.

ProviderWhat it does for usPersonal data it handlesLocation
Cloudflare, Inc. (Email Routing)Receives mail sent to our @ideascore.online addresses and forwards it to our mailbox.Sender's address and the content of the messageCloudflare's global network
Google LLC (Gmail)Our team mailbox for our @ideascore.online addresses.Correspondence with usUnited States and Google's global infrastructure
Sendinblue SAS (Brevo)Sends the emails our team writes from our @ideascore.online addresses.Recipient address and the content of our messagesEuropean Union

4. Services a Customer Chooses to Connect

These are not our Sub-processors. They receive data only when a Customer connects them and decides what to send, and the Customer's own agreement with the service applies.

ServiceWhen it receives data
Zapier, Inc. (Zapier)When a Customer connects IdeaScore to Zapier using an API key and turns on a Zap.
Make (Celonis group)When a Customer connects IdeaScore to Make using an API key and turns on a scenario.
Slack (Salesforce group) and Microsoft TeamsWhen a Customer adds an incoming-webhook address for a channel and chooses which programme events post there.
The Customer's own systemsWhen a Customer uses the IdeaScore API or registers a webhook endpoint.
The Customer's own AI engineWhen an organisation uses its own AI engine key instead of IdeaScore's.
Calendar applications (for example Google Calendar, Outlook, Apple Calendar)When a User subscribes to their private calendar feed.
Video hosts (for example YouTube)When an Applicant's pitch-video link is opened or played inside the Service.
Google Drive, Docs, Slides and Sheets, and the Google Docs viewer (Google)When an Applicant's pitch-deck or document link is opened inside the Service. A link to a PDF or Office file is shown through the Google Docs viewer, which fetches the file from that link.

5. Changes to This List

We will give at least 30 days' notice before a new Sub-processor in sections 1 or 2 starts Processing Customer Personal Data, by updating this page and emailing each Customer's owner. A Customer may object as set out in clause 5.3 of the Data Processing Agreement. In an emergency (for example to keep the Service running or secure) we may give shorter notice and will explain why.

To receive notice of changes at another address, write to [email protected].

6. Contact

Questions about this list: [email protected].

IdeaScore