Effective Date: 9 April 2026

Last Updated: 9 April 2026

Version: 1.0

01    Introduction

This document lists the Sub-Processors authorised by Vanti Ltd ("Vanti"), trading as "Smart Core", to process Personal Data on behalf of Customers in connection with the Smart Core platform and services.

This list is maintained in accordance with Section 5.4 of the Data Processing Agreement ("DPA") between Vanti and the Customer.

1.1 Notification of Changes

Vanti will notify Customers of any intended changes to this Sub-Processor List (additions or replacements) at least thirty (30) days before the change takes effect, in accordance with the DPA.

1.2 Objection Process

Customers may object to a new Sub-Processor by providing written notice to Vanti within fourteen (14) days of notification, in accordance with Section 5.4(d) of the DPA.

02    Infrastructure sub-processors

These Sub-Processors provide the core infrastructure on which the Smart Core platform operates.

Company

Purpose

Data Processed

Location

Transfer Agreement

Microsoft Azure

Microsoft Corporation

Cloud hosting, compute, virtual networking, container services

All Customer Data (storage, compute)

United Kingdom (UK South, UK West)

N/A (UK processing)

Microsoft Azure Blob Storage

Microsoft Corporation

Object storage for documents, images, floor plans, exports

Files, documents, building plans, exported data

United Kingdom

N/A (UK processing)

Microsoft Azure Service Bus

Microsoft Corporation

Asynchronous message queue processing

Event payloads, notification data, job metadata

United Kingdom

N/A (UK processing)

Microsoft Azure Application Insights

Microsoft Corporation

Application performance monitoring, error tracking, telemetry

Anonymised usage telemetry, error logs, performance metrics

United Kingdom

N/A (UK processing)

Microsoft Azure Key Vault

Microsoft Corporation

Cryptographic key management, secrets management

Encryption keys, connection strings, API credentials (encrypted)

United Kingdom

N/A (UK processing)

Service

02   Database sub-processors

Service

Company

Purpose

Data Processed

Location

Transfer Agreement

MongoDB Atlas

MongoDB, Inc.

Primary database hosting (where cloud-managed)

Account data, building data, sensor data, configuration

United Kingdom / EU

UK Adequacy (EU)

Redis Cloud

Redis Ltd

In-memory caching, session management, job queues

Session tokens, cached query results, job metadata

United Kingdom

N/A (UK processing)

Note: Where Customers deploy SC-BOS on-premises, local SQLite and/or PostgreSQL databases are managed by the Customer and are not Sub-Processors.

03   Integration sub-processors

These Sub-Processors provide specific integration capabilities used by the Smart Core platform.

Service

Company

Purpose

Data Processed

Location

Transfer Agreement

Microsoft Graph API

Microsoft Corporation

Calendar integration, directory services, email (where enabled by Customer)

User directory data, calendar events, email metadata

UK / EU(Microsoft data residency commitments)

UK Adequacy (EU) / UK IDTA

Mapbox

Mapbox, Inc.

Map rendering, geocoding, geolocation services

Building coordinates, map viewport data, location queries

United States

UK International Data Transfer Agreement (UK IDTA)

Archilogic

Archilogic AG

Indoor floor plan rendering, 3D building models

Floor plan geometry, zone definitions, building layout

Switzerland / EU

UK Adequacy (Switzerland, EU)

04   Communication sub-processors

Service

Company

Purpose

Data Processed

Location

Transfer Agreement

eement

Postmark (ActiveCampaign, LLC)

ActiveCampaign, LLC

Transactional email delivery (notifications, alerts, account emails)

Recipient email addresses, notification content, alert summaries

United States

UK International Data Transfer Agreement (UK IDTA)

Note: The specific email service provider will be confirmed and updated in this list.

05   On-premises integrations (not sub-processors)

The following third-party systems may be integrated with SC-BOS on Customer premises. These are deployed and managed by the Customer and are not Vanti Sub-Processors. Data processing is under the Customer's control.

System Name

Description

Data Processed

Gallagher

Access control system

Customer-managed; data flows through SC-BOS on Customer's infrastructure

Hikvision

CCTV and video surveillance

Customer-managed; video data remains on Customer's infrastructure

BACnet devices

Building automation protocol devices

Customer-managed; environmental and control data

OPC-UA servers

Industrial device integration

Customer-managed; industrial process data

MQTT brokers

IoT message transport

Customer-managed; device telemetry

Xovis

People counting and occupancy

Customer-managed; occupancy data

Airthings

Air quality monitoring

Customer-managed; environmental data

Helvar

Lighting control

Customer-managed; lighting data

Shelly

IoT device control

Customer-managed; device data

Steinel

Sensor integration

Customer-managed; sensor data

Schneider Electric (Wiser KNX)

KNX building automation

Customer-managed; automation data

PestSense

Pest detection monitoring

Customer-managed; pest sensor data

06   Change log

Version

Description

Date

1

Initial Sub-Processor List created

9 April 2026

07   Contact

For questions about this Sub-Processor List or to subscribe to change notifications, please contact:

Data Protection Officer

Email: dpo@vanti.co.uk

Vanti Ltd (trading as Smart Core)

10 Bonhill St, London EC2A 4PE

United Kingdom