Sub-processor List
Last updated: September 2026 · Version 1.6
Please note: This list has been prepared in good faith and is pending formal legal review before launch. The live infrastructure (regions and providers) must be re-verified against the running deployment before publishing.
This is the canonical list of third-party sub-processors Eutaxis Ltd (company number 17441843) engages to provide SectorBoard. It is referenced by the Privacy Policy, the Data Processing Agreement and the Security & Trust page. Where any other page lists sub-processors, this list prevails.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Primary database & authentication | Account, organisation, KPI and credential data (credentials encrypted) | EU (Ireland, eu-west-1) | UK/EEA — no transfer out |
| Netlify | Application hosting, serverless functions & CI/CD | Server-side request processing (authentication, sessions, KPI rendering, API handling) + request metadata incl. IP address. Connector syncs also run here, so data read from your connected apps — including the workforce records described in the Privacy Policy — passes through in transit while a sync runs | Serverless functions in US-East (AWS us-east-1); global edge CDN | UK IDTA / SCCs (US processing) |
| Stripe | Billing & payment processing | Billing contact + payment data (card data handled by Stripe directly) | United States | UK IDTA / SCCs; Stripe adequacy mechanisms |
| Google Workspace | Transactional email delivery | Recipient email address + email content | Global (US-headquartered) | UK IDTA / SCCs as applicable |
| Anthropic | AI processing — the AI add-on, the Atlas advisor (including Atlas’s autonomous overnight analysis of your KPI data), the AI KPI builder, and the usage-capped AI features available during a free trial | Computed KPI values + organisational context + director-authored notes. Where you use the AI KPI builder: the names of your own workflow status codes and tags exactly as they appear in your connected system, and the description you write when answering a connection question. No raw connector records — no jobs, invoices, customers, contacts or transactions — and no model training on inputs | United States | UK IDTA / SCCs as applicable |
| Upstash | Distributed rate limiting & brute-force account lockout | Rate-limit counters keyed on client IP address and account email address / Coach ID (no other personal data; counters expire automatically) | EU (London, eu-west-2) | UK/EEA — no international transfer |
Anthropic is engaged for Organisations on the AI add-on, for Organisations using the Atlas advisor, and during an active free trial. If your Organisation has none of these, no data is sent to Anthropic. During a free trial the AI features are available in a usage-capped form so they can be evaluated before purchase. The Atlas advisor, when enabled, analyses your KPI data automatically each night. It is enabled per Organisation and is not switched on by default; your Organisation's Admin turns it on or off in Settings → AI & Intelligence.
Changes & notifications
We give reasonable prior notice of any new or replacement sub-processor by updating this page and, where appropriate, by email. Customers may object on reasonable data-protection grounds as set out in the DPA (section 6).