Legal
Sub-processors
Last updated 19 October 2026
Every third party that processes data on our behalf, and the legal basis for any transfer of data outside the EEA. We do not currently use any other processor. This list is updated whenever that changes.
Current sub-processors
| Processor | What they do | Where | Transfer basis |
|---|---|---|---|
| Netlify, Inc. | Website hosting and content delivery | USA, served from a global edge network | EU Standard Contractual Clauses under Netlify's DPA, plus Netlify's EU–U.S. Data Privacy Framework certification |
| Stripe Payments Europe, Ltd (Ireland), with Stripe, LLC (USA) | Payment processing. Our processor for payments; an independent controller for fraud prevention and its own legal obligations | Ireland (EU) and USA | Contracted with an EU entity; US transfers under EU Standard Contractual Clauses and Stripe, LLC's EU–U.S. Data Privacy Framework certification |
| Plausible | Anonymous page and event counts | EU | None needed — EU processing |
| Resend (Plus Five Five, Inc., USA) | Delivers your report by email, but only when you ask us to. The PDF is generated per request and attached to that one message; we store neither the report nor your address | Dispatched from Ireland (EU); message metadata and delivery logs are stored in the USA | EU Standard Contractual Clauses under Resend's Article 28 DPA, plus Resend's EU–U.S. Data Privacy Framework certification |
| Supabase (not yet live) | Will store saved results, once that feature ships | To be confirmed — an EU region | None needed if EU |
A note on Stripe
Stripe is not a plain sub-processor. It is our processor for payments and an independent controller for fraud prevention and its own anti-money-laundering and legal duties, as stated in its own Data Processing Agreement.
A note on transfer certifications
Both Netlify's and Stripe, LLC's EU–U.S. Data Privacy Framework certifications are self-asserted on each company's own legal pages. Even where a certification has lapsed, the EU Standard Contractual Clauses in each company's DPA independently provide the transfer basis.
Provided for general information and transparency. This page is not legal or medical advice.