Sub-processors
The third parties we engage to help deliver our services, what they do, and where the data sits. We keep this short by design — we run most of our own stack.
Current sub-processors
We engage the providers below to deliver and support our services. Each is bound by a data-processing agreement with obligations equivalent to those we owe our clients.
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Zoho Corporation (Zoho Mail, EU DC) | Transactional & contact email delivery | EU (Netherlands) | EU data centre; SCCs where applicable |
| Cloudflare, Inc. | CDN, DNS, WAF, bot mitigation (Turnstile) | Global edge; EU data localisation available | SCCs + EU Data Protection Addendum |
| [Hosting / IaaS provider] | Compute, storage and network for hosted services | EU | EU region; DPA in place |
| [Backup / object storage] | Encrypted off-site backups | EU | EU region; DPA in place |
Changes and objections
We give advance notice of intended additions or replacements of sub-processors so controllers can object on reasonable data-protection grounds, as set out in our Data Processing Agreement. To receive change notifications, contact [email protected].
What we do not outsource
A core part of our positioning is that we operate our own infrastructure rather than reselling someone else's. Where a function is run on our own systems inside the EU, it is not a third-party sub-processor and does not appear above.
Contact
Questions about this document: [email protected]. Privacy and data-protection matters: [email protected]. You can also use our contact form.