Sub-processors
Last updated
On this page
Pro-cess relies on a small set of trusted third-party services to deliver the platform. Each one processes a specific category of data on our behalf and is bound by its own data-processing agreement with us. This page is the canonical list and is updated whenever we add, change or remove a processor.
Our Data Processing Agreement (UK GDPR Article 28) is incorporated into our Terms and applies to every account automatically; this page forms part of it. A countersigned copy is available on request at privacy@pro-cess.co.uk.
Infrastructure #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting, database (RDS), file storage (S3), cache (ElastiCache), load balancing | All customer data | London (eu-west-2) |
| Cloudflare | DNS, CDN, TLS termination, DDoS protection | HTTP request/response metadata | Global edge (cache-only) |
| Laravel Forge | Server provisioning, deploy automation | Deploy metadata only (no customer data) | UK/EU |
| Hetzner | Staging environment, off-site backup mirror | Encrypted database backups | Germany (Falkenstein) |
| Stablepoint | Disaster-recovery backup target | Encrypted database backups | London, UK |
| Enom (Tucows) | Domain registration, renewal and transfer (where a client buys a domain through us) | Registrant contact details (name, organisation, email, address, phone) for the domains a client registers | Canada / US (UK adequacy / Standard Contractual Clauses) |
| GitHub | Source control, CI/CD pipeline | Source code only (no customer data) | EU/US (Standard Contractual Clauses) |
Payments #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Stripe | Card payments, subscription billing, Stripe Connect for tenant payouts, Apple Pay / Google Pay | Payment-card data (never on our servers - hosted Stripe Elements) | Ireland (Stripe Payments Europe) |
| GoCardless | UK direct debit (Bacs) collection, recurring billing | Bank account details (collected via hosted GoCardless form, not stored by us) | London, UK |
| SumUp | In-person card terminal payments | Payment-card data (never on our servers - SumUp hosted checkout) | EU/UK |
Communications #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Twilio | Outbound SMS, VoIP calling (via the optional VoIP module) | Phone numbers, SMS content, call audio (if recording enabled) | Ireland (Twilio Ireland Ltd) |
| Brevo | Transactional email delivery | Recipient email addresses, message content | Paris, France |
| Beehiiv | Newsletter delivery (only if a tenant enables newsletter sync) | Subscriber email addresses and consent status | United States (Standard Contractual Clauses) |
| Telegram | Sparky assistant chat channel, only where a business owner links their Telegram account (opt-in) | The owner's own messages and aggregate business figures (no end-customer records) | Global (Telegram FZ-LLC, UAE). Owner opt-in channel; relies on the owner's explicit choice to use it under UK GDPR Article 49 |
Productivity & integrations #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Calendar sync, Maps for route optimisation, reCAPTCHA, OAuth sign-in | Appointment metadata, postcodes, OAuth identifiers (per tenant opt-in) | EU/US (Standard Contractual Clauses) | |
| Microsoft | Outlook OAuth sign-in (optional) | OAuth identifier and refresh token (per tenant opt-in) | EU |
| Xero | Accounting sync (invoices, payments, contacts) when a tenant connects Xero | Invoice, payment and customer contact data (tenant opt-in) | London, UK |
| Intuit (QuickBooks) | Accounting sync when a tenant connects QuickBooks Online | Invoice, payment and customer contact data (tenant opt-in) | EU/US (Standard Contractual Clauses) |
| DVLA | Vehicle lookup for automotive trades (registration to make/model) | UK vehicle registration plates (no driver data) | UK |
AI & monitoring #
| Processor | Purpose | Data category | Region |
|---|---|---|---|
| Anthropic | AI content generation (email campaigns, service descriptions, brand voice) and the Sparky assistant answering an owner's questions about their own business | Tenant brand-voice context and prompts, and the owner's assistant questions with aggregate business figures (counts and totals). No end-customer records are sent from our systems | United States (Standard Contractual Clauses; API inputs are not used to train models) |
| OpenAI | Fallback AI provider for content generation | Same as Anthropic; used only when Anthropic is unavailable | United States (Standard Contractual Clauses) |
| Sentry | Error monitoring and performance telemetry | Technical error data only; PII scrubbed at source | Frankfurt, Germany (EU) |
Changes to this list #
Pro-cess customers can subscribe to changes on this page by emailing privacy@pro-cess.co.uk. We'll give at least 30 days' notice before adding a new sub-processor to allow customers to object under their Data Processing Agreement.