Subprocessors

How this list works

We list subprocessors by category and name only the payment processor and the analytics provider, which you meet directly in checkout and the cookie banner. Clients see the current named list in the client dashboard; prospective clients can ask for it through the contact form. We notify clients at least 30 days before adding a subprocessor that processes Client Personal Data, and each subprocessor is bound by data protection terms no less protective than our Data processing addendum.

Cloud hosting, database and content delivery

• Purpose: hosting the website and application, application database, file storage, contact-form submissions and internal notification emails.
• Data: all application data, including account and client workspace data.
• Location: primary storage in the United States; encrypted delivery of the Site from more than 125 countries.
• Transfer mechanism: UK Extension to the EU-US Data Privacy Framework where certified, otherwise the UK Addendum to the EU Standard Contractual Clauses.

Payment processing: Stripe

• Provider: Stripe Payments Europe, Limited and Stripe, Inc.
• Purpose: card payments, subscriptions, invoices, tax calculation and the customer billing portal.
• Data: billing contact, company and tax details, payment method (held by Stripe only), invoice history.
• Location: Ireland and the United States.
• Transfer mechanism: UK adequacy regulations (EEA); UK Extension to the EU-US Data Privacy Framework (United States).

Business email, documents and consented analytics: Google

• Provider: Google Ireland Limited and Google LLC.
• Purpose: business email and documents, and, only with consent, website analytics through Google Analytics 4 and Tag Manager.
• Data: correspondence with clients and prospects; pseudonymous website usage data where consented.
• Location: the EEA and the United States.
• Transfer mechanism: UK adequacy regulations; UK Extension to the EU-US Data Privacy Framework.

Transactional email (when enabled)

• Purpose: sending invitations, password resets and report notifications.
• Data: recipient name and email address, message content.
• Location: the United States.
• Transfer mechanism: UK Extension to the EU-US Data Privacy Framework where certified, otherwise the UK Addendum to the EU Standard Contractual Clauses.

Software development tools (no client data)

• Purpose: source code hosting and automated testing.
• Data: source code only. No client personal data is stored there.
• Location: the United States.