Legal
Sub-processors
Last updated: 6 July 2026
The short version
The third-party services that help us run Airprose, what each does, and where it processes data. Each is bound by data-protection terms at least as strict as our own.
Core hosting in the UK
Your database and worker services run in the UK.
AI processing
Anthropic drafts responses; your content isn't used to train models.
Notice before changes
We tell you before adding a new sub-processor.
Core infrastructure
These process customer data for every account.
| Sub-processor | Purpose | Region | Transfer basis |
|---|---|---|---|
| Supabase | Database, authentication, file storage | UK (London) | UK — none required |
| Vercel | Application hosting, compute, CDN | US compute / global CDN | DPF / SCC [•] |
| DigitalOcean | Document editor & analysis worker | UK (London) | UK — none required |
| Anthropic | AI drafting & analysis (content not used to train models) | US | DPF / SCC [•] |
| Resend | Transactional email | EU / US | DPF / SCC [•] |
| Stripe | Billing & payments (merchant of record) | US / global | DPF / SCC [•] |
Analytics & monitoring
| Sub-processor | Purpose | Region | Transfer basis |
|---|---|---|---|
| PostHog | Product analytics (only if you accept analytics cookies) | US | DPF / SCC [•] |
| Sentry | Error & performance monitoring | US | DPF / SCC [•] |
Library connectors (opt-in)
These only receive data if you choose to connect them to import library content. If you don't connect them, they process nothing.
- Google (Drive) — US / global
- Dropbox — US / global
- Notion — US / global
- Atlassian (Confluence) — US / global
Changes to this list
If we add or replace a sub-processor, we'll update this page (and the "last updated" date above) and give active customers reasonable prior notice so they can object on reasonable data-protection grounds, as set out in our Data Processing Agreement.