← Back to Trust
Sub-processor Register
A current list of third-party sub-processors, including purpose, data categories, and processing locations.
| Service | Purpose | Data categories | Location/Region | Transfer mechanism |
|---|---|---|---|---|
| Microsoft Azure | Hosting, DB, storage | Pseudonymised customer data, logs | Ireland (primary), EU failover | EEA processing; SCCs if cross-region |
| Microsoft 365 | Corporate email & docs | Business contact, docs | EU/EEA (tenant config) | SCC |
| Stripe | Payments/billing | Billing contact; payment tokens | EU + US processing | SCCs/DPF as applicable |
| HubSpot | CRM & marketing | Lead/contact data | EU DC (may use US support) | SCCs (incl. DPF if applicable) |
| GitHub | Source control | Dev identities; code | EU/US | SCCs/DPF as applicable |
| OpenAI | LLM narrative generation | Derived metrics & prompts (no raw PII) | US | SCCs Module 3 (processor) |
| Xero | Accounting data source | Financial records; vendor/customer names | Customer's region (Xero) | Customer's own transfer basis |
| QuickBooks Online | Accounting data source | Financial records; vendor/customer names | Customer's region (Intuit) | Customer's own transfer basis |