Sub-processors
Every third party, with purpose and region.
We use a small number of specialist services to deliver the platform. This list is the canonical reference: we'll re-publish it if anything changes.
Current sub-processors
| Sub-processor | Purpose | Region | Status |
|---|---|---|---|
| Neon | Managed Postgres: the primary database for all customer data. | EU-west-2 (London) | Live |
| Cloudflare R2 | Object storage for documents: right-to-work, certifications, uploaded evidence. | EU bucket | Live |
| Vercel | Compute and edge platform that serves the web application and API. | Global edge (EU preferred for customer data) | Live |
| Stripe | Subscription billing and per-reveal credit purchases. Card data never touches our infrastructure. | UK/EU (Stripe Ireland) | Live |
| Resend | Transactional email delivery (verification, password reset, billing receipts). | EU | Live |
| Twilio | SMS delivery for verification codes and operational alerts. Activation pending: listed here in advance so the catalogue is honest. | EU | Pending activation |
| Companies House API | Read-only lookup of employer companies during signup. We don't send personal data; we only query by company number / name. | UK (Crown Service) | Live |
| postcodes.io | Postcode normalisation for employer and site addresses. | UK | Live |
| Yoti | Identity verification (IDV). Queued for activation when signup volume crosses the trigger threshold. | UK | Pending activation |
Changes
If we add, remove, or change a sub-processor we will update this page. Material additions are also notified via in-product banner to admins of affected tenants.