We use a small number of carefully-selected sub-processors to deliver the Supplio platform and this website. This page is the live, authoritative list. Updates take effect 30 days after this page is updated, in accordance with section 5 of our Data Processing Addendum.
To receive email notifications when this list changes, email privacy@supplio.co.uk with the subject "Sub-processor notifications: subscribe" and tell us the email address to use.
Current sub-processors
| Sub-processor | Service provided | Data processed | Region | Transfer safeguard |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. and affiliates Privacy | Subscription billing, payment processing, payment-method storage, invoice generation, fraud screening, checkout cookies. | Cardholder name, billing email, billing address, payment-method details, IP address, device data, subscription metadata (organisation ID, plan ID). | Ireland (controller for EEA / UK acquiring) with onward processing in the United States by Stripe, Inc. | UK International Data Transfer Addendum to the EU SCCs for UK → US transfers; EU SCCs for EEA → US transfers; PCI-DSS Level 1. |
| Resend Inc. Privacy | Transactional email delivery: platform emails (supplier and user invitations, password resets, two-factor and security notices, reminders and notifications) and contact-form responses from the marketing site. | Recipient email, sender email, subject line and message body, which can contain names, organisation name, invitation link tokens, custom messages and contact-form content. | United States. | UK Addendum to the EU SCCs / EU SCCs; encryption of message content in transit. |
| Cloudflare, Inc. Privacy | Content delivery network, DDoS protection, web application firewall, TLS termination and the encrypted tunnel to our servers for supplio.co.uk and app.supplio.co.uk. | IP address, request headers, user-agent, request paths, cookies (passed through), TLS handshake metadata. | Global edge network. Primary processing in the United States with EU/UK edge nodes. | UK Addendum to the EU SCCs / EU SCCs; logs minimised; Cloudflare is a signed Data Privacy Framework participant where applicable. |
| Vercel Inc. Privacy | Hosting of the marketing site (supplio.co.uk), including its server functions for organisation sign-up, Stripe Checkout and the contact form, and Vercel Web Analytics, which counts page views without cookies. | IP address, user-agent and request paths; sign-up details on their way to the platform (name, organisation name, password and, where needed, a two-factor code); the email address and company name sent to Stripe Checkout and the billing events Stripe sends back; contact-form name, email, company and message; page views with referrer, country, browser, operating system and device type, with visitors told apart by a request hash that Vercel discards after 24 hours. | United Kingdom (London) for the server functions; pages are served from Vercel's global edge network. Vercel Inc. is based in the United States. | EU SCCs with the ICO's UK Addendum under Vercel's DPA; Vercel is certified under the EU-U.S. Data Privacy Framework; TLS in transit. |
| OVHcloud and affiliates Privacy | Application servers hosting the Supplio platform, and object storage for uploaded files and encrypted database backups. | All personal data processed by Supplio while it is being served, plus uploaded files and their metadata (filename, type, size, uploader, upload time) and encrypted database backups. | United Kingdom (London). | Data stored in the UK. OVHcloud is headquartered in France, an adequate jurisdiction. Object storage encrypted at rest (AES-256); TLS in transit; database backups encrypted by Supplio before upload. |
| Neon, LLC (managed PostgreSQL) Privacy | Managed PostgreSQL databases holding the platform's data, with point-in-time recovery and snapshots. | All personal data processed by Supplio, including account data, billing references, supplier and supplier-portal data, Customer Data entered into the platform, and audit logs. | United Kingdom (London, on Amazon Web Services eu-west-2). Neon's own operations and support providers include companies in the United States. | Data stored in the UK. UK International Data Transfer Addendum and EU SCCs under Neon's DPA for any access from outside the UK; encryption at rest (AES-256) and TLS in transit. |
| Photon (komoot GmbH), OpenStreetMap Nominatim (OpenStreetMap Foundation) and postcodes.io Privacy | Address autocomplete, placing addresses on the map, and UK postcode validation used during supplier and organisation onboarding. | The address being typed, searched for or placed on the map, plus the user's IP address as part of the request. No account identifier is sent. | Germany (Photon) / United Kingdom (Nominatim, postcodes.io). | Adequate jurisdictions; requests carry only the address and the network details of the request, with no account identifier. |
| Google LLC and affiliates (Google Analytics) Privacy | Website analytics for supplio.co.uk, loaded only after a visitor accepts analytics cookies and never on the sign-up or checkout pages. Not used in the Supplio platform. | For visitors who accept analytics cookies: a random visitor identifier from the _ga cookie, pages viewed, referrer, scroll and outbound-link events, browser, device and approximate location. Google states that Google Analytics 4 does not log or store IP addresses. No Customer Data. | United States, with processing in Google's global data centres. | Google LLC is certified under the EU-U.S. Data Privacy Framework and its UK Extension. Google signals and ad personalisation are switched off. |
Affiliates and infrastructure detail
Some sub-processors above operate through affiliates within the same group (for example, Stripe Payments Europe, Ltd. and Stripe, Inc.). References to a sub-processor include its affiliates that are necessary to deliver the relevant service.
The specific hosting region and object-storage provider used for an Enterprise customer is confirmed in the relevant order form. Self-serve customers (Starter, Growth, Scale plans) are hosted in the default region described in the DPA.
Changes to this list
We will give at least 30 days' advance notice on this page of any new or replacement sub-processor that processes Customer Personal Data, except where a shorter notice period is necessary to address a security or legal need (in which case we will explain the reason and give as much notice as is reasonable).
Questions
Sub-processor questions? Email privacy@supplio.co.uk.