Legal
Subprocessors
The infrastructure providers that touch personal data on our behalf. Each is under a written contract that binds it to at least the protections in our Privacy Policy, and none of them may use your data for their own purposes.
Last updated 29 August 2026
Infrastructure
| Provider | What it processes | Where |
|---|---|---|
| Vercel Inc. | Application hosting and delivery. Sees request data in transit — IP address, page requested — and holds short-lived server logs. | United States, European Union |
| Upstash, Inc. | The account store: name, email address, hashed password, setup answers and subscription status. | United States |
| Cloudflare, Inc. | Document storage. Holds uploaded identity documents and company records, encrypted at rest in a bucket with no public URL. | United States, European Union |
| Stripe, Inc. | Payments. Takes card details directly from your browser and holds the billing record. We never receive a card number. | United States |
| Microsoft Corporation | Product analytics and session recording (Clarity). Sees page interactions with text input masked, unless you turn analytics off; see the Cookie Policy. | United States |
| Google LLC | Site analytics (Google Analytics 4). Sees pages visited and an analytics identifier, unless you turn analytics off. | United States |
Partners are not subprocessors
The formation agents, registered agents, CPAs and immigration counsel who do the regulated work are not subprocessors. They contract with you directly and act as controllers of the data you give them, for their own professional and record-keeping obligations. Which partner is instructed depends on the matter and the jurisdiction, and we tell you who it is before we instruct them.
Transfers
Where a provider on this list processes personal data outside the UK or EEA, the transfer runs on the EU standard contractual clauses and the UK International Data Transfer Addendum. Details are in section 5 of the Privacy Policy.
Changes to this list
This page is the current list. We update it before a new subprocessor starts handling personal data, and if you have asked us to, we will email you when it changes so you have a chance to object.