Sub-processors
Every third party that processes data on our behalf, where it does so, and why. This is the list, not a summary of one.
Last updated 11 September 2026
At a glance
| Processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Vercel | Hosting, TLS and content delivery | United Kingdom (London) for functions; global edge for static files | UK-based processing |
| Supabase | Database and authentication | United Kingdom (London, eu-west-2) | UK-based processing |
| Cloudflare | Authoritative DNS, and email forwarding for our contact address | Global anycast network; mail transits Cloudflare | UK International Data Transfer Agreement |
| Sentry | Error monitoring | Germany (Sentry EU region) | UK adequacy regulations, which cover transfers to the EEA |
What each one actually sees is below. That is the part a category name cannot tell you.
Vercel
Hosting, TLS and content delivery. Serves every request, so it necessarily observes IP addresses and request paths in its operational logs. Functions are pinned to London, which is where the scope check and enquiry endpoints handle an email address someone types. Static files carry no personal data, so serving them from a nearer edge costs nothing in residency.
Supabase
Database and authentication. The only sub-processor holding customer data at rest: organisations, sites, determinations, procedures, people and competency records, plus scope-check summaries and enquiries. Row-level security means the application reaches it as the signed-in user, so no key the website holds can read across customers.
Cloudflare
Authoritative DNS, and email forwarding for our contact address. Answers DNS, which reveals nothing about individuals. It also forwards mail sent to our contact address, so it handles the content of those messages in transit. Records are served unproxied, so Cloudflare does not sit between visitors and the site.
Sentry
Error monitoring. Configured to hold no personal data at all. Automatic collection of request bodies, headers, cookies and IP addresses is off, and every event is scrubbed before it is sent: the user object is removed outright and identity-shaped fields are redacted wherever they appear. Session Replay and performance tracing are both disabled: replay would record what a person typed into the scope check, which is the data we say we do not collect.
What is not on this list
Web analytics. Runs on our own domain and records page views, referrer and approximate country. It sets no cookie, builds no profile and produces nothing we could attribute to a person. Described in full in the privacy notice.
Transactional email. Nothing sends mail from this domain. Our published mail records instruct receiving servers to reject anything that claims to.
What would change this list
Adding any service that receives data on our behalf, including one that only sees it in transit. Two are foreseeable and not yet used: transactional email for the platform, and a document renderer for evidence packs, planned as something we run rather than a service we hand procedures to.
This page changes on the same day the service does, not at the next review. If you are assessing us and something here is unclear, ask. The answer is a better use of both our time than an assumption.