Every security review asks for this list. Publishing it is faster than answering the question forty times, and it lets you check the transfer story before we are on a call.
A sub-processor is a vendor that processes personal data on our behalf when we act as a processor for you. This page lists the ones we use in our own business — the tools behind this website, our email and our documents.
It is deliberately not the list for your system. The models, clouds and databases in a system we build for you are contracted by you, chosen with you during design, and named in the proposal and in your own records of processing. That is the arrangement we recommend, because it keeps you in the controller's seat and means our vendor list never becomes a dependency of your compliance position. The GDPR page covers how that is designed, and the privacy policy sets out our commitments as a processor.
| Vendor | Purpose | Processing location | Data categories |
|---|---|---|---|
| Google Ireland Limited | Website analytics (Google Analytics 4), loaded only after consent | Ireland (EU), with onward transfers to the United States under the EU–US Data Privacy Framework | Page views, approximate location derived from IP, device and browser type. No form contents. |
We tell clients under a data processing agreement before adding or replacing a sub-processor that touches their data, so there is time to object.
Whichever the constraints select, and the choice is yours to contract. We shortlist against your residency, retention and capability requirements, then design so that changing provider later is an engineering task rather than a rebuild. The provider appears in your records of processing, not ours.
Usually not. Systems we build run in your cloud accounts against your data stores. Where an engagement genuinely requires us to process personal data — a migration, a debugging window, an evaluation set — it happens under a data processing agreement, for a defined period, and the data is returned or deleted at the end.
Yes, in the ordinary case. We read it, flag anything we cannot meet rather than signing and hoping, and sign before any personal data reaches us.
Clients under a data processing agreement are notified in advance of a change that affects their data, with time to object. This page carries the date it was last reviewed so you can see whether it is current.
Send us the questionnaire. We would rather answer it properly once than trade emails for three weeks.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
