Last updated: 11 September 2026
A sub-processor is a third-party organisation we use to help deliver our service, that may process personal data as part of that. Below is our complete list, we keep this genuinely short by hosting almost everything ourselves.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Stripe | Payment processing | Payment and billing details. We never see or store your card details ourselves. | Global (UK/EU data handling available); Stripe acts as an independent controller for payment data. |
| Microsoft 365 | Transactional email (welcome emails, onboarding links, account notifications) | Your name and email address, and the content of the specific email being sent. | UK/EU |
| Fasthosts | Server hosting for our self-hosted platform | All customer data, as it's stored on infrastructure we run on Fasthosts' servers. Fasthosts does not access this data as part of normal operation. | United Kingdom |
| Civo | Off-site encrypted backup storage | Nightly automated backups of platform data, encrypted before they ever leave our server. Civo cannot read this data - it only ever receives an encrypted archive. | United Kingdom |
Everything else - your questionnaire answers, generated policy documents, the compliance platform itself, our automation and document-generation engines - runs on infrastructure we control directly. We don't route your business or security data through any third-party AI service, analytics provider, or additional cloud platform.
If we add or change a sub-processor, we'll update this page and, for material changes, notify active customers directly.