Trust

Our sub-processors.

Every security review asks for this list. Publishing it is faster than answering the question forty times, and it lets you check the transfer story before we are on a call.

Last reviewed 5 September 2026 · Engineering and procurement guidance, not legal advice.

WHAT THIS COVERS

A sub-processor is a vendor that processes personal data on our behalf when we act as a processor for you. This page lists the ones we use in our own business — the tools behind this website, our email and our documents.

It is deliberately not the list for your system. The models, clouds and databases in a system we build for you are contracted by you, chosen with you during design, and named in the proposal and in your own records of processing. That is the arrangement we recommend, because it keeps you in the controller's seat and means our vendor list never becomes a dependency of your compliance position. The GDPR page covers how that is designed, and the privacy policy sets out our commitments as a processor.

THE LIST

Vendor	Purpose	Processing location	Data categories
Google Ireland Limited	Website analytics (Google Analytics 4), loaded on every visit	Ireland (EU), with onward transfers to the United States under the EU–US Data Privacy Framework	Page views, approximate location derived from IP, device and browser type. No form contents.

We tell clients under a data processing agreement before adding or replacing a sub-processor that touches their data, so there is time to object.

QUESTIONS

QUESTIONS — 4

Whichever the constraints select, and the choice is yours to contract. We shortlist against your residency, retention and capability requirements, then design so that changing provider later is an engineering task rather than a rebuild. The provider appears in your records of processing, not ours.

Usually not. Systems we build run in your cloud accounts against your data stores. Where an engagement genuinely requires us to process personal data — a migration, a debugging window, an evaluation set — it happens under a data processing agreement, for a defined period, and the data is returned or deleted at the end.

Yes, in the ordinary case. We read it, flag anything we cannot meet rather than signing and hoping, and sign before any personal data reaches us.

Clients under a data processing agreement are notified in advance of a change that affects their data, with time to object. This page carries the date it was last reviewed so you can see whether it is current.

Keep reading

Trust

GDPR & EU Data Residency

→

Enterprise

Procurement & Security Review

→

Legal

→

30-minute technical call · no deck