In force from 12 October 2026
To deliver the service we use a small number of trusted sub-processors. Each is bound by data protection obligations no less protective than our data processing terms. This page lists the sub-processors that may process personal data on your behalf.
A supplier appears here only if personal data belonging to you or your users can reach it. Tools we use to build and run the product that hold no such data, such as our source code repository, are not sub-processors and are not listed.
| Provider | Purpose | Location |
|---|---|---|
| LCN (Team Blue) | Server hosting and data storage | United Kingdom |
| Microsoft Graph / Exchange Online | Directory sync and mail-flow provisioning in your Microsoft 365 tenant, and delivery of our transactional email | Your own tenant's region, which is the United Kingdom for a tenant set up in the UK. Our transactional email is sent from our tenant in the United Kingdom |
| Microsoft 365 | Our own business email and file storage, which is where correspondence with you is held | United Kingdom |
| Stripe | Payment processing and card vaulting | United States and India, in Stripe's data centres, handled by Stripe's companies in Ireland and the United Kingdom |
| Xero | Our accounting records: the invoices we raise and the payments we receive, with the company name, address, VAT number and billing contact of each customer we invoice directly and of each reseller and distributor | United States, with processing in New Zealand and Australia |
| Cloudflare | DNS and network security for service endpoints, and the check that a message sent through our website's contact form comes from a person | Each request is handled at the nearest of Cloudflare's data centres, in the United Kingdom for UK visitors. Logs and account data are held in the United States |
| NinjaOne | Server monitoring, patch management and remote administration | Germany (EU) |
| SentinelOne | Endpoint threat detection and response on our servers | Germany (EU) |
| Google Cloud (Web Risk) | Checking the web addresses used in campaigns against Google's lists of unsafe sites | Google's data centres worldwide |
Where a sub-processor holds data outside the UK, the transfer is protected. UK adequacy regulations cover the European Economic Area, which includes Germany, and New Zealand. Transfers to the United States are made under the UK Extension to the EU-US Data Privacy Framework where the provider is certified to it, and otherwise under the UK International Data Transfer Addendum to the Standard Contractual Clauses, as are transfers to any other country.
We check a VAT number you give us against the European Commission's VIES service, and we may look a company up by its company number in its country's official register, such as Companies House, or in the public Legal Entity Identifier index run by GLEIF, to confirm that it exists and whether it has entered an insolvency procedure. Only the VAT or company number is sent, and what comes back is the public record. These registers do not process personal data on our behalf, so they are not sub-processors and are not listed above.
We will update this page when we add or replace a sub-processor, and give notice as described in our data processing terms so you may object on reasonable grounds. To be notified of changes, email [email protected].
The fingerprint is the SHA-256 of the version's exact text: a saved copy whose fingerprint matches is that version, word for word.