Sub-processors
Last updated 15 September 2026
Keep this page accurate. It is referenced by the Data Processing Addendum, and business customers rely on it. Update it before adding a provider, not after. Replace the table below with the providers this installation actually uses.
Last updated: [date]
1. Why this page exists
Running a file transfer service means relying on a few other companies — somewhere to keep the files, somewhere to run the application, something to send email. Under data protection law those companies are our sub-processors, and you are entitled to know who they are before you trust us with a client's work.
2. Current sub-processors
| Provider | What it does | Data it can reach | Location |
|---|---|---|---|
| [Object storage provider] | Stores uploaded files until they expire | File contents and generated storage identifiers. Not filenames, titles or messages. | [region] |
| [Hosting provider] | Runs the application and the database | Account details, transfer metadata, hashed download records | [region] |
| [Email provider] | Sends transfer notifications, password resets and receipts | Recipient email addresses, sender name, transfer title and link | [region] |
| [Payment provider] | Takes subscription payments | Billing name, email, card details — which we never see ourselves | [region] |
| [Identity provider, if Google sign-in is enabled] | Verifies who you are when you choose "Continue with Google" | Your Google account identifier, email address and name | [region] |
3. What they are not allowed to do
Each is bound by contract to process data only on our instructions, to keep it confidential, to apply appropriate security, and never to use it for its own purposes. None of them is permitted to sell it or to use it for advertising.
4. Changes
We give at least [30] days' notice before adding or replacing a sub-processor. To be told when this page changes, email [support email] and ask to be added to the notification list.
If you object to a new sub-processor on reasonable data protection grounds, the process is in section 5 of the Data Processing Addendum.