Sub-processors
Who else touches your data.
Every third party that processes client data on our behalf, what it does, and where it runs. Client records and audit documentation stay in the UK and EU. We will tell you before this list changes.
| Sub-processor | Purpose | Location | Data |
|---|---|---|---|
| Amazon Web Services | Document storage, encryption, transactional email, and Claude model inference via Amazon Bedrock | eu-west-2 (London) | Client documents, audit working papers, model inputs and outputs |
| Google Cloud | Gemini model inference via Vertex AI, used as the independent second draft | europe-west (EU) | Model inputs and outputs |
| Neon | Managed PostgreSQL database | aws-eu-west-2 (London) | Engagement records, audit documentation, audit trail |
| PostHog | Product analytics, proxied first-party through our own domain | EU (eu.i.posthog.com) | Usage events and request metadata; no client documents or audit content |
| Vercel | Application hosting | lhr1 (London) for server-side execution | Request data in transit; no client data at rest |
| WorkOS | Authentication and single sign-on | United States | Name, email address and authentication events. No client financial data. |
| Cloudflare | DNS and bot protection on public forms | Global edge | IP address and request metadata on public pages only |
| Sentry | Error monitoring | EU region | Error diagnostics. Configured to exclude document content and personal data. |
No sub-processor uses your data to train a model, and none is permitted to. Model inference is contractually zero-retention and geographically restricted to the UK and EU.