Sub-processors
Every third party that processes personal data on our behalf, what it does, and where it sits. Adding one takes 30 days’ notice.
Current sub-processors
| Sub-processor | What it does | Location |
|---|---|---|
| Stripe Payments Europe Ltd. | Payment processing | Ireland (EEA) |
| OpenAI Ireland Ltd. | Language-model drafting and chat | Ireland (EEA) — zero-day retention |
| MongoDB Atlas | Primary database | London, UK |
| Cloudflare, Inc. | CDN and bot management | Global (TLS-only edge) |
| Postmark / Mailgun | Transactional email | EU regions |
This list is part of the Data Processing Agreement and is kept current there as well.
The sub-processors above
Changes to this list
Adding a sub-processor requires 30 days’ advance notice to controllers. You may object by email to [email protected], and terminate the affected service if a workaround cannot be agreed.
International transfers
No personal data leaves the UK or EEA without an appropriate transfer mechanism — Standard Contractual Clauses, the UK International Data Transfer Addendum, or both. Sub-processors are pinned to UK and EEA regions wherever the service supports region pinning.