Last updated: 18 April 2026
A subprocessor is a third-party service provider we use to help deliver the Service. This page lists every subprocessor that handles personal data relating to your account, staff, or volunteers, along with what each is used for and where it processes data.
Each subprocessor is bound by a contract that imposes substantially the same data protection obligations as those in our Data Processing Agreement. International transfers are covered by the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge) or Standard Contractual Clauses.
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Application hosting, edge delivery, and privacy-friendly analytics | United States (UK-US Data Bridge) |
| Neon | Managed PostgreSQL database hosting for venue, PPP, and training data | European Union |
| Resend | Transactional email delivery (magic links, training reminders) | United States (UK-US Data Bridge) |
| OAuth sign-in, where the user chooses Google as their sign-in method | United States (UK-US Data Bridge) | |
| Stripe | Payment processing for subscriptions | United States (UK-US Data Bridge) |
We will notify registered account holders by email at least 30 days before adding a new subprocessor that handles venue or staff data. If you have a reasonable objection on data protection grounds, tell us within 15 days of the notice and we will use reasonable efforts to address it, including by offering a workaround or allowing you to cancel your subscription without penalty for the unused period.
To be added to the subprocessor change notification list, email jack@standardtier.co.uk. Registered paying customers are on the list automatically.