Sub-processors
On this page
Pro-cess relies on a small set of trusted third-party services to deliver the platform. Each one processes a specific category of data on our behalf and is bound by its own data-processing agreement with us. This page is the canonical list and is updated whenever we add, change or remove a processor.
Our Data Processing Agreement (UK GDPR Article 28) is incorporated into our Terms and applies to every account automatically; this page forms part of it. A countersigned copy is available on request at [email protected].
Planned changes #
Notice given 30 August 2026. Takes effect no earlier than 29 September 2026.
We are moving outbound email delivery from Brevo (Paris, France) to Amazon Simple Email Service, running in the same AWS London region (eu-west-2) that already hosts the platform.
The data category is unchanged: recipient email addresses and message content. The practical effect is that email is delivered from infrastructure already listed on this page rather than from an additional vendor, and that data stops leaving the UK for this purpose.
If you have a reasonable data-protection objection, tell us at [email protected] before 29 September 2026 and we will work it through with you under your Data Processing Agreement.
Infrastructure #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting, database (RDS), file storage (S3), cache (ElastiCache), load balancing. Outbound email delivery from 29 September 2026, see Planned changes. | All customer data | London (eu-west-2) |
| Cloudflare | DNS, CDN, TLS termination, DDoS protection | HTTP request/response metadata | Global edge (cache-only) |
| Laravel Forge | Server provisioning, deploy automation | Deploy metadata only (no customer data) | UK/EU |
| Hetzner | Staging environment, off-site backup mirror | Encrypted database backups | Germany (Falkenstein) |
| Stablepoint | Disaster-recovery backup target | Encrypted database backups | London, UK |
| Enom (Tucows) | Domain registration, renewal and transfer (where a client buys a domain through us) | Registrant contact details (name, organisation, email, address, phone) for the domains a client registers | Canada / US (UK adequacy / Standard Contractual Clauses) |
| GitHub | Source control, CI/CD pipeline | Source code only (no customer data) | EU/US (Standard Contractual Clauses) |
Payments #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Stripe | Card payments, subscription billing, Stripe Connect for tenant payouts, Apple Pay / Google Pay | Payment-card data (never on our servers - hosted Stripe Elements) | Ireland (Stripe Payments Europe) |
| GoCardless | UK direct debit (Bacs) collection, recurring billing | Bank account details (collected via hosted GoCardless form, not stored by us) | London, UK |
| SumUp | In-person card terminal payments | Payment-card data (never on our servers - SumUp hosted checkout) | EU/UK |
Communications #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Twilio | Outbound SMS, VoIP calling (via the optional VoIP module) | Phone numbers, SMS content, call audio (if recording enabled) | Ireland (Twilio Ireland Ltd) |
| Brevo | Outbound email delivery. Being replaced by Amazon SES, see Planned changes. | Recipient email addresses, message content | Paris, France |
| Beehiiv | Newsletter delivery (only if a tenant enables newsletter sync) | Subscriber email addresses and consent status | United States (Standard Contractual Clauses) |
| Telegram | Sparky assistant chat channel, only where a business owner links their Telegram account (opt-in) | The owner's own messages and aggregate business figures (no end-customer records) | Global (Telegram FZ-LLC, UAE). Owner opt-in channel; relies on the owner's explicit choice to use it under UK GDPR Article 49 |
Productivity & integrations #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Calendar sync, Maps for route optimisation, reCAPTCHA, OAuth sign-in | Appointment metadata, postcodes, OAuth identifiers (per tenant opt-in) | EU/US (Standard Contractual Clauses) | |
| Microsoft | Outlook OAuth sign-in (optional) | OAuth identifier and refresh token (per tenant opt-in) | EU |
| Xero | Accounting sync (invoices, payments, contacts) when a tenant connects Xero | Invoice, payment and customer contact data (tenant opt-in) | London, UK |
| Intuit (QuickBooks) | Accounting sync when a tenant connects QuickBooks Online | Invoice, payment and customer contact data (tenant opt-in) | EU/US (Standard Contractual Clauses) |
| DVLA | Vehicle lookup for automotive trades (registration to make/model) | UK vehicle registration plates (no driver data) | UK |
AI & monitoring #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Anthropic | AI content generation (email campaigns, service descriptions, brand voice) and the Sparky assistant answering an owner's questions about their own business | Tenant brand-voice context and prompts, and the owner's assistant questions with aggregate business figures (counts and totals). No end-customer records are sent from our systems | United States (Standard Contractual Clauses; API inputs are not used to train models) |
| OpenAI | Fallback AI provider for content generation | Same as Anthropic; used only when Anthropic is unavailable | United States (Standard Contractual Clauses) |
| Sentry | Error monitoring and performance telemetry | Technical error data only; PII scrubbed at source | Frankfurt, Germany (EU) |
Changes to this list #
Pro-cess customers can subscribe to changes on this page by emailing [email protected]. We'll give at least 30 days' notice before adding a new sub-processor to allow customers to object under their Data Processing Agreement.