Authorised Sub-processors
Version: 2026.1 · Last Updated: 14 September 2026
To deliver the Sponsor Licence Ready AI cloud platform, we engage third-party sub-processors to assist with infrastructure hosting, database management, transactional messaging, and payment processing.
Each sub-processor is subject to rigorous security evaluation and bound by written data processing agreements ensuring compliance with the UK GDPR and the Data Protection Act 2018.
Verified Sub-processors Register
Google Cloud Platform & Firebase
Google Ireland Limited / Google LLCPurpose / Services: Cloud application hosting (Cloud Run), production database (Firestore), object storage for encrypted evidence (Cloud Storage), authentication, AI document extraction (Vertex AI), and automated ClamAV malware scanning.
Primary Processing Location: europe-west4 (Eemshaven, Netherlands / European Union).
Transfer Safeguards: UK Adequacy Regulations, EU Standard Contractual Clauses (SCCs), and ISO 27001 / SOC 2 Type II certifications.
Stripe Payments Europe, Limited
Stripe, Inc. (United States / Ireland / UK)Purpose / Services: Customer payment card processing, subscription management, and Customer Billing Portal operation. Payment card details are tokenized directly by Stripe.
Processing Locations: United Kingdom, European Union, and United States.
Transfer Safeguards: UK International Data Transfer Addendum, PCI-DSS Level 1 certification, and SOC 2 Type II compliance.
Resend, Inc.
Resend, Inc. (United States)Purpose / Services: Delivery of transactional emails, system alerts, password resets, and team invitation links.
Processing Locations: United States / European Union.
Transfer Safeguards: Standard Contractual Clauses (SCCs) and UK Addendum.
Sub-processor Change Notification Policy
In accordance with our Data Processing Agreement, we will provide customer organisations with at least thirty (30) calendar days' advance written notice prior to engaging any new or replacement sub-processor.
Customers may object to any proposed sub-processor appointment on legitimate data protection grounds by submitting a written objection within thirty (30) days of notification to privacy@sponsorlicenceready.co.uk.