Sub-processors

Version sub-processors-2026-10-10, in effect from 10 October 2026.

This is the list of every third party that processes data on our behalf in delivering ProofPack, as of 24 September 2026, with the changes of 7, 8 and 10 October 2026 described under “What changed on this page”. None of them receives customer test-set rows, model outputs or patient data, because none of that leaves the customer’s environment. Each row names what the party does touch. Where a contracting entity or transfer mechanism is stated, we read it from the provider’s published terms on the date given; where we could not, the row says [unverified].

In use today

Party	Purpose	Data it touches	Region	Contracting entity and transfer terms
Anthropic	Our director’s AI assistant, Claude, used on 8 and 10 October 2026 to prepare our first outreach list: it read the public pages and company registers the contact details came from and wrote the details into our contact list	The published work contact details on that list (names, job titles, work email addresses, the pages they were read from and the companies’ register records), as the outreach privacy notice says. No customer data	Anthropic is a US company; where it processed this use is [unverified]	Anthropic, PBC, United States; which of Anthropic’s terms applied to this use, and its transfer terms for it, are [unverified]
Cloudflare	Hosting of this site (Pages, serving it since 15 September 2026) and the eight server endpoints (Functions): checkout, quote, quote PDF, quote acceptance, payment webhook, the runner telemetry receiver (POST /api/telemetry), whose code was added on 22 September 2026, the outreach stop link (/u/), whose code was added on 2 October 2026, and the export of the stop link’s records to our sending software (GET /api/suppression-export), whose code was added on 8 October 2026. Since 7 October 2026 also the site’s database (D1: accounts, subscriptions, licences, quotes, quote acceptances, payment events, the runner telemetry records and the record the outreach stop link writes when it is used) and the private file store for quote PDFs (Workers KV), reached through the site’s Pages bindings. No analytics product is enabled.	Connection data of anyone who loads a page (IP address, page requested), held by Cloudflare to serve it; the form data and telemetry records passing through the endpoints; since 7 October 2026, the records listed in the purpose cell, held in D1, and the quote PDFs, held in Workers KV; the network error reports a browser sends to a.nel.cloudflare.com when a request to this site fails, described in section 1 of the privacy notice	Global edge network. The D1 database runs in Cloudflare’s Western Europe region (WEUR), with no jurisdiction restriction set (wrangler d1 info, read 7 October 2026). Cloudflare is a US company	Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States: the data importer named in Cloudflare’s customer data processing addendum (version 6.4, effective 3 April 2026), which forms part of the customer’s subscription agreement with Cloudflare. Transfers from the UK: the EU standard contractual clauses as amended by the UK International Data Transfer Addendum (clause 6.2(b)). Read 24 September 2026
Supabase	Postgres database (accounts, subscriptions, licences, quotes, quote acceptances, payment events and the runner telemetry records) and the private storage bucket for quote PDFs; project created 18 September 2026. Our server used it until 7 October 2026, when it switched its database and quote-PDF storage to Cloudflare (the row above), and has written nothing to it since. The project’s address did not resolve when we checked on 7 October 2026, and we have not deleted the records written to it before then	The commerce records listed in section 2 of the privacy notice, and the runner telemetry records clause 2.1 of the DPA lists (ten fields and a receipt time; no IP address). No outreach record is held here	Project in Ireland (EU)	Supabase Pte. Ltd, 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513: the data importer named in Supabase’s data processing addendum (version 1, 1 August 2026), which forms part of Supabase’s terms of service. Transfers from the UK: the UK International Data Transfer Addendum issued by the Information Commissioner (schedule 2, paragraph 2.3). Read 24 September 2026
Stripe	Card payments, customer records, quotes, invoices and subscriptions; account connected 18 September 2026. Our site used its test-mode keys until 8 October 2026 and has used its live keys since then. The first live payment, made by our director through the card checkout, was taken on 8 October 2026 and refunded	Legal entity, buyer name and email, billing address, card details (Stripe only), and the PO number; on the quote route the accounts-payable email, which is the email on the Stripe customer record. In the checkout’s or the quote’s details: the model name, the plan and model count, the terms and DPA versions accepted, and, on the quote route, the buyer email and which procurement documents you need	Stripe, Inc. is a US company; the contracting entity is Irish (next cell); where the account’s data is processed is [unverified]	Stripe Payments Europe, Limited, Ireland - the Stripe contracting entity for a United Kingdom account, with Stripe Payments UK Ltd as an additional party where Stripe’s financial-services terms say so (stripe.com/gb/legal/ssa, read 21 September 2026). Transfers from the UK: Stripe’s data processing agreement (last updated 18 November 2025, section 6.1) applies its Data Transfers Addendum, whose section 5 is the UK International Data Transfer Addendum. Read 24 September 2026
Resend	Transactional email only, never marketing mail: the licence file; the quote with its acceptance link; and, when we run it, a digest sent to our director alone. API key created 18 September 2026	Recipient email, the licensee’s legal-entity name, the licence file, the quote. For the digest: up to ten messages our reply-reading software read in the seven days up to the digest’s date, each cut to its first 60 words, with the date it was read and, for a reply to our outreach email, the company’s name, the recipient’s role group and the identifier of the highest-weighted public record we hold for the company, with messages the software classed as a request to stop, an out-of-office reply or a bounce left out; the names of companies in our outreach records; and the number of active licences for which 45 days or more have passed since the last telemetry record we received for the licence, or since it was issued if none has arrived, and the number for which 60 days or more have passed, each count with the id of at most one of the licences it counts. The reply-reading software can read the outreach mailbox through the connection our director signed in on 8 October 2026, and from 12 October 2026 a scheduled task runs it	eu-west-1 (Ireland) for the sending domain, read from the MX record on send.globalphoenix.co.uk (feedback-smtp.eu-west-1.amazonses.com, DNS read 21 September 2026); Resend is a US company	Plus Five Five, Inc. (“Resend”), named in Resend’s data processing addendum (updated 27 August 2026), which binds on entering Resend’s terms. Transfers from the UK: the EU standard contractual clauses as amended by the UK International Data Transfer Addendum (section 6.4). Read 24 September 2026
Google (Workspace / Gmail)	Our company mailboxes: the support and licence addresses, and the mailbox any marketing email will be sent from and replied to	Whatever you send us by email; replies to any outreach email	Google is a US company; the Workspace data region setting is [unverified]	Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland - the Google contracting entity for a customer with a United Kingdom billing address, for Google Workspace and Google Cloud alike (cloud.google.com/terms/google-entity, read 21 September 2026). Google’s Cloud Data Processing Addendum applies to Google Workspace (read 24 September 2026); the part of it naming the UK transfer mechanism could not be read, so the mechanism is [unverified]
GitHub	Source hosting. Until 8 October 2026 also continuous integration, the build that publishes this site, the scheduled jobs that collect public regulatory records for outreach, and the digest job; all of them have been switched off since 8 October 2026, and this site is built and published from our director’s computer	No customer data. Until 8 October 2026 the public-record collectors wrote a file of company names, device records and public record identifiers, with no person in it, which GitHub keeps for 30 days. The digest job (the Resend row) reads no database today, so the digest it renders on GitHub holds no message and no licence id; GitHub keeps that digest as a file for 30 days and, because the job prints it, in the job’s log for as long as the repository keeps logs, 90 days under its setting on 24 September 2026. We will change this row before that job reads a database. GitHub lists no run of the digest job. GitHub still holds earlier versions of our sending software’s repository, removed from its history on 10 October 2026, that contain one named person’s work address and one general inbox at a company we set aside from our outreach, until GitHub deletes them, as the outreach privacy notice says under “Where we keep it”.	United States	GitHub, Inc., United States. GitHub’s data protection agreement (October 2025) uses the UK International Data Transfer Addendum for UK transfers (section 7.B(iii)) and forms part of the GitHub Customer Agreement; whether it covers the account we use is [unverified]. Read 24 September 2026
jsDelivr	Content delivery network for the Pyodide runtime files the in-browser demo loads, on /demo only; in use since 18 September 2026, when /demo was published	Connection data of anyone who opens /demo (IP address, files requested), held by jsDelivr to serve the files. Nothing you drop on the demo page: the file is parsed inside your browser tab. Our automated browser test drops a 2,000-row file on the demo and checks that every request the page makes is a GET to this site or to cdn.jsdelivr.net with no body and no query string	Global edge network; [unverified: the operating entity’s country]	[unverified: jsDelivr’s operating entity; its published terms page names no legal entity, read 24 September 2026]

Listed for completeness, not in use

Party	Purpose	Status on 2026-09-24
Anthropic	An optional narrative feature for the runner, deferred past version 1.0	Not in use. The runner has no code that sends anything to a language model, and nothing in version 1.0 calls one

Named before it starts

This party will process the text of some email sent to us, from the date in its last column. It is listed now so the row is on the record before any email reaches it.

Party	Purpose	Data it touches	Region	Contracting entity, transfer terms and retention	From
Anthropic	A yes-or-no check inside our support software, on email sent to our support address (support@). The software asks the model claude-opus-5-5, through the Anthropic API (api.anthropic.com), whether a message asks for a regulatory opinion, a judgement on whether a model or a result is good enough, advice on acceptance criteria, margins, thresholds or sample size, or prices or contract terms, or contains patient data, table rows or model outputs. An answer of yes, or no clear answer, or any error, passes the message to Josh, who replies himself, and the software also sends the sender an automatic reply: fixed text we wrote, saying that the message has been passed to Josh and that he will reply within one business day. Only after an answer of no may the software’s automatic reply answer the question itself, with sentences quoted word for word from our documentation and a closing note that Josh replies to anything further. The model writes no part of any reply	The subject of a support email and the sender’s newest text: the body up to the first reply header the software recognises (such as a line “On … wrote:” or -----Original Message-----) or the footer of our own outreach emails, with each line that starts with “>” removed (text below such a line is kept; a reply header the software does not recognise, such as “From:” followed by a name with no address, is kept with the text below it) and without lines of our own standard reply text. It is sent only when the message has passed every earlier filter: no filter for data or for a listed kind of request fired, our documentation has a section that matches it, and the text holds no digit or other numeric character (a number written in words, such as “three”, is not stopped by this filter), no email address, no reference to the sender’s own model or results, no request for our view, and no word outside the words our documentation uses and common short words such as “the” and “how” (a personal name is usually such a word, so a signed message is usually not sent). Never sent: attachments (the software records only that a message has one, never a file name or its contents, and a message with an attachment is passed to Josh without being sent), the sender’s address and the other email headers, earlier messages quoted with “>” or below a recognised reply header, and every message a filter stopped. The software accepts only the single word yes or no back; anything else counts as no clear answer	Anthropic, PBC is a US company. Where Anthropic processes an API request is [unverified]: we did not read it from Anthropic’s published terms	Anthropic Ireland, Limited: Anthropic’s Commercial Terms of Service (effective 17 June 2025) name it as the Anthropic party for a customer in the UK, and Anthropic, PBC for a customer elsewhere. Those terms incorporate Anthropic’s Data Processing Addendum (effective 24 February 2025), whose Schedule 3 applies the UK International Data Transfer Addendum to processing under the UK GDPR. Retention: Anthropic’s privacy centre says it deletes API inputs and outputs within 30 days of receiving them, except where it keeps them longer to enforce its usage policy, to comply with the law, under a separate agreement, or under its rules for models it calls Covered Models; whether claude-opus-5-5 is one is [unverified]. No zero-data-retention agreement is in place. Read 2 October 2026	The day our support software is first connected to the support@ mailbox; we will write that date here. On 2 October 2026 it is not connected, and no email received at support@ has been sent to Anthropic

What changed on this page

On 18 September 2026 we corrected Cloudflare’s purpose, which an earlier version described as including “cookie-less analytics”. No analytics of any kind is enabled on this site, as the trust page says; if analytics is ever switched on, this page and the trust page change together, with the notice below. On 21 September 2026 jsDelivr moved into the first table, because /demo has existed since 18 September 2026. On 24 September 2026 this list took effect as a live document, with each provider’s contracting entity and transfer terms read from its published terms where we could read them. On 2 October 2026 Anthropic’s support row moved out of the not-in-use table into its own section, because the support software that will call it has been written; it starts only when that software is connected to the support@ mailbox. On 7 October 2026 the site switched its database and quote-PDF storage from Supabase to Cloudflare (D1 and Workers KV); Cloudflare already hosted the site and its server endpoints, so no new party was added. Cloudflare’s row now lists them, and Supabase’s row says what remains there. On 8 October 2026 Cloudflare’s row added an eighth server endpoint, the export of the stop link’s records to our sending software; Cloudflare already ran the other seven, so no new party was added. On the same day Supabase’s row stopped saying that our outreach contact and message records would be held there: they will be kept in a database file on the computer that runs our sending software, as the outreach privacy notice says.

On 8 October 2026 Stripe’s row changed because our site switched from the account’s test-mode keys to its live keys that day; the row also gives the first live payment, taken that day and refunded. Stripe was already on this list, so no new party was added.

On 10 October 2026 Resend’s row changed: it now says that the reply-reading software can read the outreach mailbox, and from when a scheduled task runs it. Resend was already on this list, so no new party was added. GitHub’s row changed the same day: the jobs it ran have been switched off since 8 October 2026, and it still holds two outreach addresses in earlier versions removed from our repository’s history. Anthropic joined the first table the same day, for our director’s use of its AI assistant, Claude, on 8 and 10 October 2026 to prepare our first outreach list; that use processed no customer personal data, so the notice period under “Change notice” did not apply. Anthropic’s row under “Named before it starts”, for our support software, is unchanged.

International transfers

Cloudflare’s D1 database for this site runs in its Western Europe region, Supabase’s project is in Ireland, and Resend’s sending domain is in its eu-west-1 (Ireland) region. Cloudflare, Stripe, Resend, Google and GitHub are, or are owned by, US companies; Supabase’s contracting entity is in Singapore; and jsDelivr’s operating entity and its country are [unverified] above. Anthropic, PBC, named in two rows above, is a US company, and where it processes a request is [unverified]. Where a transfer of personal data leaves the United Kingdom, it is made under the provider’s data-processing terms, as each row states. Where a row says [unverified], we have not confirmed the mechanism from the provider’s terms; we will confirm it on request before you rely on it. Ask and we will send you the provider’s terms.

Change notice

We will give 30 days’ notice before a new sub-processor starts processing customer personal data, by updating this page and emailing the contact on each customer account. Removing a sub-processor, or a change of region that keeps the data inside the UK or the EU, is published here without a notice period. Clause 11 of the data processing agreement sets out what you can do if you object.