Current sub-processors
| Provider | Purpose | Processing region | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication, storage, edge functions | UK (London, eu-west-2) | UK/EEA — no transfer |
| Amazon Web Services | Underlying infrastructure for the database and storage | UK / EU | UK/EEA — no transfer |
| AWS S3 (continuity escrow) | Weekly encrypted, tamper-evident copy of each firm's records and documents, held so they survive the platform | UK (London, eu-west-2) | UK/EEA — no transfer |
| Vercel | Hosting and edge network for the app and marketing site | USA (EU edge locations) | EU-US Data Privacy Framework |
| Cloudflare | DNS for adviseriq.co.uk (DNS only — no application data path) | Global anycast | Cloudflare DPA |
| AWS SES | Transactional and firm-branded email delivery | UK (London, eu-west-2) | UK/EEA — no transfer |
| AWS SNS | SMS delivery | UK (London, eu-west-2) | UK/EEA — no transfer |
| AWS Bedrock (Anthropic Claude) | AI processing for document reading, drafting, analysis and the assistant | UK/EU (London entry point; processed within the EEA) | UK adequacy — EEA processing, no retention, no model training |
| Deepgram | Speech-to-text for call transcription | USA | Standard Contractual Clauses (UK Addendum) |
| Didit | Identity verification, KYC/AML, PEP and sanctions screening | EU (Netherlands) | UK/EEA — no transfer |
| GoCardless | Direct Debit collection and subscription billing | UK | UK/EEA — no transfer |
| Stripe | Legacy and international payment processing | USA | EU-US Data Privacy Framework |
| Mortgage Brain | Mortgage product sourcing and lender criteria | UK | UK/EEA — no transfer |
| Xero | Commission reconciliation and management accounts | UK / EU | Xero DPA |
| Sentry | Error monitoring; PII scrubbed before send | USA | EU-US Data Privacy Framework |
| PostHog | Product analytics; anonymous event metadata only | EU (EU Cloud) | UK/EEA — no transfer |
Where your data is stored
Customer data — client records, documents, fact finds, suitability letters and communications — is stored in the United Kingdom (AWS eu-west-2, London), including backups. AI processing for the assistant runs through AWS Bedrock in the same region, so prompts containing client data do not leave the UK.
The providers listed above as USA-based receive limited, specific data for the purpose stated — not your client bank. Each is relied on under the transfer basis shown.
Changes
We provide at least 30 days' notice before adding or replacing a sub-processor. Customers may object on reasonable grounds and we will work in good faith to address concerns.