List of sub-processors — Version 1.0
In force from: 05/08/2026
Until 27 October 2026 the sub-processors page showed Annex 3 of the DPA: this is that text, the same in versions 1.0 and 1.3 of the DPA.
Sub-processors
| Sub-processor | Activity | Processing location | Basis for any transfer |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Application hosting, managed relational database, e-mail sending, serverless functions, storage | European Union — Ireland (eu-west-1) | No transfer for storage. Support access from third countries covered by Standard Contractual Clauses |
| MongoDB Ltd / MongoDB, Inc. | Managed document database holding tenant data | European Union | Standard Contractual Clauses for non-EEA support access |
| Cloudflare Ltd / Cloudflare, Inc. | Content delivery network, application protection, edge execution of the front-end | European Union, on a globally present network | Standard Contractual Clauses |
| Stripe Payments Europe Ltd (Ireland) | Payment and recurring billing management. In respect of payment and anti-fraud data, Stripe acts as an independent controller | European Union — Ireland, with group access | Standard Contractual Clauses |
The Processor engages no further sub-processors for the processing of the Controller's data. As at the date of this DPA no statistical measurement or tracking tools are active on the application or on tenants' public pages; should any be enabled, this Annex will be updated with the notice period set out in clause 8.3.
The Processor's internal staff and collaborators act as authorised persons under Article 29 GDPR and not as sub-processors.