Subprocessors
Last updated 2026-10-16
These are the third parties that process customer personal data on our behalf. We give customers notice before adding one, as our DPA requires.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Railway Corporation | Application hosting: web servers, background workers, PostgreSQL database and Redis queue. | All customer data held in the application database, in transit through the application. | United States |
| Cloudflare, Inc. (R2) | Object storage (R2) for uploaded evidence documents and data-export archives. | Uploaded documents and export archives, encrypted at rest. | United States |
| Resend, Inc. | Transactional email: sign-in, invitations, questionnaire links, reminders, notices. | Recipient email addresses and the content of the emails we send. | United States |
| Anthropic, PBC | AI analysis of uploaded evidence and drafting of assessment narratives.Only for organizations on a plan with AI analysis, when an analysis is requested. | Extracted text of documents you choose to analyse, and assessment context. Not used to train models. | United States |
| HubSpot, Inc. | Website visitor tracking and marketing analytics.Only after a visitor accepts analytics cookies; nothing is loaded or sent before that. | Pages viewed, referrer, device and browser details, and a visitor cookie ID, linked to a contact only if the visitor sends us an enquiry. | European Union (HubSpot's EU data centre); HubSpot, Inc. is based in the United States |
| Google LLC (Google Analytics 4) | Website and product usage analytics.Only when Google Analytics is switched on, and only after a visitor accepts analytics cookies; nothing is loaded or sent before that. | Pages viewed, referrer, approximate location, device and browser details, and steps such as sign-up, including campaign parameters from the landing page. No names, email addresses or vendor data. | United States and other countries where Google operates |
| Microsoft Corporation (Microsoft Clarity) | Session recordings and heatmaps of how pages are used.Only when Clarity is switched on, and only after a visitor accepts analytics cookies; nothing is loaded or sent before that. | Pages viewed, clicks, scrolling and page layout, and a recording of the marketing site. Signed-in workspace content is masked. No names, email addresses or vendor data. | United States and other countries where Microsoft operates |
| PostHog, Inc. | Product analytics.Only when a PostHog project key is set, and only after a visitor accepts analytics cookies. | Pages viewed and product events such as sign-up, including campaign parameters from the landing page. No names, email addresses or vendor data. | European Union when the default EU cloud host is used. A deployment can point PostHog at another host. |
| Functional Software, Inc. (Sentry) | Error monitoring for the application. | Stack traces and request metadata. Request bodies and personal data are excluded by configuration. | United States |
Payments: our reseller
Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns. Paddle sells our paid plans to you and handles the billing, payment and tax details it collects under its own privacy notice, rather than on our instructions, so it is not a subprocessor under our DPA. We list it here so you know who receives that data.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Paddle.com Market Ltd | Online reseller and Merchant of Record for our paid plans: checkout, payment processing, sales tax and VAT, invoicing, and refunds.Only when an organization buys a paid plan. | Billing name and email, billing address and country, tax ID if given, and payment details, which Paddle collects and holds; we never see card numbers. | United Kingdom, European Union and United States |