Sub-processor Registry

Sub-processor Registry

Last reviewed 6 November 2026

CimotaTech Ltd / Handwriting HorizonsUnder the UK General Data Protection Regulation (UK GDPR), CimotaTech Ltd operates as a Data Processor on behalf of our partner schools and Multi-Academy Trusts (the Data Controllers). To ensure absolute transparency, we maintain this public registry of all third-party Sub-processors and infrastructure partners used to deliver the Handwriting Horizons platform.

Crucial Data Guarantee: CimotaTech maintains a strict data isolation policy. No personal data—regardless of age, role, or consent status—is ever provided to, processed by, or sold to external third-party marketing, analytics, or artificial intelligence services (such as Anthropic/Claude or OpenAI).

1. Authorized Core Sub-processors

These are the enterprise infrastructure providers that directly handle, host, or route encrypted Customer Personal Data (such as Wonde MIS class rosters) strictly for the purpose of delivering the Handwriting Horizons software.

  • Google Cloud Platform (GCP)
    • Role: Cloud Hosting & Primary Database Infrastructure.
    • Data Processed: Encrypted pupil and staff data required to run the application.
    • Location: United Kingdom (London / Cardiff regions).
    • Safeguards: ISO 27001 certified, AES-256 encryption at rest, TLS 1.3 in transit.
  • Wonde Ltd
    • Role: Secure MIS API Integration.
    • Data Processed: Read-only synchronization of school Management Information System (MIS) data (e.g., class rosters, UPNs, and specific SEND indicators required for pedagogical tailoring).
    • Location: United Kingdom.
    • Safeguards: School-controlled access portal, direct revocation rights, automated offboarding.

2. Identity & Authentication Partners (SSO)

To eliminate the need for insecure passwords, CimotaTech routes authentication through the enterprise Identity Providers (IdPs) already managed by your school or Local Authority. We do not store passwords.

  • Microsoft (Azure AD / Entra ID) - Authentication routing for Microsoft-based schools.
  • Google Workspace for Education - Authentication routing for Google-based schools.
  • Hwb Cymru (Welsh Government) - Native authentication routing for all Welsh maintained schools.
  • (Note: Authentication routing is managed via our dedicated Zitadel Identity and Access Management instance, hosted entirely within our secure Google Cloud UK environment).

3. Internal Engineering & Operations (Zero Pupil Data)

For full transparency to Data Protection Officers, CimotaTech utilizes the following world-class toolchain to build, test, and deploy our software. None of these services have access to, nor do they process, Customer or Pupil Personal Data.

  • Atlassian Suite (Jira, Bitbucket, Confluence): Used strictly for internal project management, technical documentation, and secure source code hosting.
  • CircleCI: Used for automated continuous integration and deployment (CI/CD) pipelines. Operations are performed exclusively on synthetic/dummy data.
  • Claude Code (Anthropic): Used by our engineering team as a localized AI coding assistant. No production databases, customer logs, or pupil information are ever exposed to or used to train these models.
  • Ionos: Used strictly for corporate domain registration and external DNS routing.

Subscribe to Sub-processor Updates

In accordance with our Data Processing Agreement (DPA), CimotaTech will notify the contracting Data Protection Officer (DPO) of any intended changes concerning the addition or replacement of core Sub-processors at least 30 days prior to the change.To request our full Data Protection Impact Assessment (DPIA) or to inquire about our infrastructure architecture, please contact: compliance@cimotatech.com