Last updated: 1 September 2026
Customer data is stored and processed in the United Kingdom. The providers below process customer data on our behalf under our Data Processing Agreement. To receive notice of changes to this list, email [email protected].
| Subprocessor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| DigitalOcean, LLC | Application and database hosting | All Customer Data: user accounts, organisations, monitored assets, alerts, integrations, audit and billing records | United Kingdom (London) | UK hosted. Entity is US-based; UK International Data Transfer Addendum in the provider DPA |
| Amazon Web Services EMEA SARL | Data storage and processing | Monitored assets, exposure findings, service logs | United Kingdom (London) | UK hosted (eu-west-2); AWS Data Processing Addendum |
| Cloudflare, Inc. | Network delivery, security and backup | Request metadata in transit, contact-form submissions, encrypted backups | Global edge network; backups stored in Western Europe | Cloudflare DPA with EU SCCs and UK Addendum |
| Resend, Inc. | Email delivery | Recipient name and email address, alert and notification content, exposure report attachments | European Union (Ireland) | EU hosted; UK adequacy regulations for the EEA. Entity is US-based; Resend DPA with UK Addendum |
| Stripe Payments Europe, Ltd. | Payments and invoicing | Billing contact name and email, organisation name and address, payment card data (held by Stripe only) | European Union and United States | Stripe DPA with EU SCCs and UK Addendum |
| Functional Software, Inc. (Sentry) | Error monitoring | Error context, request URLs, organisation and user identifiers where present in an error | European Union (Germany) | EU hosted; UK adequacy regulations for the EEA. Entity is US-based; Sentry DPA with UK Addendum |
| Anthropic, PBC | AI summaries of exposure findings | Exposure details for monitored assets (affected logins, threat categories, malware family, dates). Not used for model training | United States | UK International Data Transfer Addendum |
| GitHub, Inc. | Software delivery | Transient administrative access during deployments. No Customer Data is retained | United States | UK International Data Transfer Addendum |
| Tailscale Inc. | Private networking | Network metadata only. Customer Data is end-to-end encrypted and not visible to the provider | Canada and United States | UK International Data Transfer Addendum |