Current sub-processors
| Provider | Purpose | Processing region | Transfer basis |
|---|---|---|---|
| Supabase (Amazon Web Services) | Cloud hosting and data storage | United Kingdom (eu-west-2) | UK — no transfer |
| Vercel | Application hosting, content delivery, and PDF rendering | United Kingdom (lhr1) for application functions; global edge for static content | UK — no transfer (Vercel Inc.: EU-US Data Privacy Framework, UK Extension) |
| Didit | Electronic AML and identity verification checks | European Union | UK adequacy (EEA) |
| Amazon Web Services (SES) | Email delivery, with delivery notifications through Amazon SNS | United Kingdom (London, eu-west-2) | UK — no transfer |
| Amazon Web Services (Bedrock) | AI features — document reading, extraction, summarisation and drafting | London (eu-west-2) entry point; may be processed in another AWS region within the European Economic Area | UK adequacy (EEA); no retention, no model training |
| Anthropic | AI features when AWS Bedrock is unavailable (automatic fallback) | United States, under the UK International Data Transfer Addendum | UK International Data Transfer Addendum. Last resort only — not used while AWS Bedrock is up. Anthropic holds a request for a maximum of 30 days, then deletes it; never used for model training |
| ClickSend (Sinch) | SMS delivery and two-way client text messaging | Australia (AWS Sydney); monitoring and analytics sub-processors in North America. International transfers under Standard Contractual Clauses with the UK International Data Transfer Addendum. | Standard Contractual Clauses with the UK International Data Transfer Addendum |
| Speechmatics | Speech-to-text transcription — only for firms that switch on call recording transcription, voice dictation or meeting notes | European Union (Speechmatics EU1/EU2 regions) | UK adequacy (EEA) |
| GoCardless | Direct Debit collection | United Kingdom | UK — no transfer |
| MortgageBrain | Mortgage product sourcing | United Kingdom | UK — no transfer |
| Legal & General (L&G Ignite) | Mortgage product sourcing | United Kingdom | UK — no transfer |
| Iress | Mortgage and protection product sourcing | United Kingdom | UK — no transfer |
| PropertyData | Property valuations, sales history and property facts for client addresses | United Kingdom | UK — no transfer |
| Sentry | Application error monitoring | Germany (ingest.de.sentry.io) | UK adequacy (EEA) |
| PostHog | Product analytics | European Union (eu.i.posthog.com) | UK adequacy (EEA) |
Where your data is stored
Customer data, client records, documents, fact finds, suitability letters and communications, is stored in the United Kingdom (AWS eu-west-2, London), including backups.
AI processing is not UK-only: AI features run on AWS Bedrock within the European Union. Requests enter through AWS London and are processed in AWS's EU regions, under UK adequacy regulations. Anthropic in the United States is solely a last resort: it is used only if AWS Bedrock is down, never in normal running. A request sent there is held by Anthropic for a maximum of 30 days, then deleted, and is never used for model training (UK International Data Transfer Addendum). Text messages go through AWS in London unless a firm chooses its own dedicated text number, which ClickSend provides from Australia. Other providers outside the UK receive only the data needed for the purpose shown, under the transfer basis shown.
This list is the same as Schedule 2, Part D of the Adviser IQ Subscription Agreement.
Changes
We give at least 14 days' written notice before adding or replacing a sub-processor (30 days for a change of hosting provider). Customers may object on reasonable data protection grounds and we will consider any objection in good faith, as set out in the Subscription Agreement.