Schedule 2: Authorised sub-processors (as at 17 October 2026)
| Sub-processor | Service | Location of processing | Transfer safeguard |
|---|---|---|---|
| Supabase Pte. Ltd. | Database hosting, authentication | Data at rest: London, UK (AWS eu-west-2). Support and onward sub-processors may access it from outside the UK | Supabase DPA incl. UK Addendum to EU SCCs |
| Resend (Plus Five Five, Inc.) | Email sending, and receiving replies sent to our reply address (Resend holds the received message) | United States | UK Extension to EU-US DPF (UK-US data bridge); SCCs + UK Addendum in Resend DPA |
| Cloudflare, Inc. | Website hosting and Worker functions (incl. the scheduled follow-up job) | Geographically distributed data centres, which may be outside the UK and EEA | UK Addendum to the EU SCCs; Cloudflare also complies with the Data Privacy Framework (including the UK Extension) |
| Stripe Payments Europe, Limited (Stripe Payments UK Ltd is an additional party in some cases) | Billing for the Controller's subscription. No Customer Personal Data is sent to Stripe | UK / EU / US | Stripe DPA (listed for completeness; Stripe processes account/billing data) |
| Functional Software, Inc. (Sentry) | Error reporting (technical error details and the page address) | Stored in Frankfurt, Germany (EU region); some account and organisation data is stored in the United States | Data Privacy Framework (including the UK Extension); EU SCCs with the UK Addendum as a fallback |
[Solicitor/Laszlo: confirm current entities and certifications before publishing; list Resend's own sub-processors by link.]