SiteWrite · Sub-processors · v1.2
Sub-processors
Version 1.2 · Last updated 15 June 2026
1. What this page is
1.1
A “sub-processor” is a third party that processes Personal Data on our behalf in connection with the SiteWrite service. We engage sub-processors to provide hosting, AI, monitoring, payments, analytics, email, and similar services. We remain liable to our customers for what our sub-processors do.
1.2
Each sub-processor in the table below has a written agreement with us that imposes data protection obligations equivalent in substance to those we owe to our customers under the Data Processing Addendum (the “DPA”). Section 5 separately describes certain browser and device features, and services we do not treat as sub-processors.
1.3
Where Personal Data is transferred outside the United Kingdom to a sub-processor, the transfer is protected by an appropriate mechanism recognised under UK GDPR, as set out in the table.
2. Current sub-processors
The sub-processors listed below are engaged by SiteWrite Ltd at the date shown at the top of this page. Some sub-processors are engaged in respect of our marketing website only; others process data within the SiteWrite application. The “Service area” column shows which.
| Sub-processor | What it processes for us | Service area | Where data is processed | Transfer mechanism |
|---|---|---|---|---|
| Cloudways Ltd Managed hosting (WordPress) |
Hosts the SiteWrite marketing website at sitewrite.ai. Acts as managed-hosting layer over DigitalOcean infrastructure (see below). | Marketing site | United Kingdom (London) | UK domestic — no international transfer |
| DigitalOcean, LLC Underlying cloud infrastructure |
Provides the virtual server underlying our Cloudways hosting. Hosts the marketing site files, database and logs. | Marketing site | United Kingdom (London region) | UK domestic — no international transfer |
| Supabase Inc. Database, authentication, file storage, edge functions |
Hosts the SiteWrite application database, authenticates users, stores uploaded files and report data, and runs edge functions that broker requests between the application and other sub-processors. Acts as the primary store of Customer Data. | Application | European Union (Ireland) | UK adequacy regulations (EEA) |
| Vercel Inc. Application hosting, edge network |
Hosts and serves the SiteWrite field application and firm administration application, routes requests via its global edge network, and runs serverless functions (including report PDF generation and report email dispatch) that process report content in memory. | Application | United States (Washington, D.C. — region iad1); content delivered via global edge locations | International Data Transfer Agreement / UK Addendum to the EU SCCs |
| Anthropic PBC AI Write large language model |
Provides the Claude large language model used by the AI Write feature. Receives structured inputs from authorised users and returns generated text for review. Under its applicable commercial terms, inputs submitted via the API are not used to train general models. | Application | United States | International Data Transfer Agreement / UK Addendum to the EU SCCs |
| Cloudflare, Inc. DNS, edge protection, bot mitigation |
Provides DNS, content delivery and bot protection for sitewrite.ai and application sub-domains. Sets the __cf_bm cookie listed in our Cookie Policy. |
Marketing site & application | Global edge network (closest edge to user) | International Data Transfer Agreement / UK Addendum to the EU SCCs |
| Cloudflare, Inc. (R2 object storage) Off-site encrypted backup of Customer files |
Stores an off-site, encrypted backup copy of uploaded files — photographs, generated Reports, firm logos, signature images, and organisation documents — for resilience and disaster recovery. | Application | European Union / EEA (Cloudflare R2, Western Europe) | UK adequacy regulations (EEA); Cloudflare IDTA / UK Addendum applies to any support access from outside the UK/EEA |
| Stripe Payments Europe Limited (and affiliates) Subscription billing |
Processes subscription payments, holds billing details, and handles invoicing. Card details are tokenised; SiteWrite does not store full payment card numbers. | Application | European Union (Ireland) with onward transfers to Stripe Inc. in the United States | UK adequacy regulations (EEA) and International Data Transfer Agreement / UK Addendum to the EU SCCs (for US onward transfer) |
| Resend, Inc. Transactional email delivery |
Delivers transactional emails (account verification, password reset, billing notifications, system alerts) and report-delivery emails to recipients. Holds recipient email addresses, message content (which may include a report PDF attachment), and delivery metadata for a short period to support delivery and bounce handling. | Application | United States | International Data Transfer Agreement / UK Addendum to the EU SCCs |
| Ideal Postcodes (IDDQD Limited) UK address lookup |
Receives postcodes or partial addresses entered by users and returns matching UK property addresses during survey setup. | Application | United Kingdom | UK domestic — no international transfer |
| Functional Software, Inc. (Sentry) Error monitoring and observability |
Captures application errors and performance traces to allow us to diagnose and fix issues. May incidentally collect user identifiers, IP addresses, and the URL or feature in use at the point of error. Session replay is disabled and the PII flag is off; event payloads are scrubbed of Customer Data where reasonably practicable. | Application | European Union (Sentry EU data region, Germany) | UK adequacy regulations (EEA) |
| Loom, Inc. (Atlassian) Embedded help / tutorial videos |
When a user plays an embedded help video, the Loom iframe receives the user’s IP address and browser/device information in order to stream the video. | Application | United States | International Data Transfer Agreement / UK Addendum to the EU SCCs |
| ipify IP address lookup (consent records) |
Returns the end user’s public IP address, which is recorded against the user’s acceptance of our legal terms as part of the consent record shown to firm administrators. | Application | United States | International Data Transfer Agreement / UK Addendum to the EU SCCs (confirm a written agreement is in place — see note) |
| Plausible Insights OÜ Privacy-respecting website analytics |
Provides aggregated, cookieless analytics for sitewrite.ai. Does not set cookies, does not retain IP addresses, and does not build cross-site profiles. See our Cookie Policy for details. | Marketing site | European Union (Germany) | UK adequacy regulations (EEA) |
| Microsoft Ireland Operations Limited (Microsoft 365) Email hosting for hello@sitewrite.ai |
Hosts the hello@sitewrite.ai mailbox and any other SiteWrite business mailboxes. Processes incoming and outgoing email, including customer correspondence and support enquiries. | Marketing site & application | European Union / United Kingdom (Microsoft 365 EU Data Boundary) | UK adequacy regulations (EEA) |
| Slack Technologies Limited Internal communications (incidental sub-processor) |
Used for internal team communications. May incidentally process Personal Data where customer support correspondence, incident details, or sales context is shared internally. Not used as a primary channel for customer support tickets. | Internal operations | European Union (Ireland) with onward transfers to the United States | UK adequacy regulations (EEA) and International Data Transfer Agreement / UK Addendum to the EU SCCs (for US onward transfer) |
| monday.com Ltd. Internal task and project management (incidental sub-processor) |
Used for internal product, support and operational task tracking. May incidentally process Personal Data where customer onboarding tasks, support tickets, or feature requests reference a named customer or user. Not used as the primary store for support correspondence. | Internal operations | European Union (Germany / Ireland) with onward transfers to the United States and Israel | UK adequacy regulations (EEA) and International Data Transfer Agreement / UK Addendum to the EU SCCs (for US and Israel onward transfers) |
3. Categories of data processed by each sub-processor
3.1
The specific categories of Personal Data shared with each sub-processor are limited to what is necessary for that sub-processor to provide its service. In summary:
- Cloudways and DigitalOcean process whatever data is held within or transmitted to the WordPress marketing site, including any enquiry submissions and basic request logs.
- Supabase processes the full set of Customer Data and account data described in Annex 1 of the DPA.
- Vercel processes whatever data is transmitted between the user’s browser and the application, together with request and edge logs, and processes report content in memory when generating report PDFs and dispatching report emails.
- Anthropic processes only the structured inputs sent from an AI Write request (and returns generated text). Customer end-client identifiers should not normally form part of these inputs; customers are responsible for not including personally identifying material in free-text fields submitted to AI Write.
- Cloudflare (DNS/CDN) processes request metadata (IP address, user agent, requested URL) for routing, caching and bot detection.
- Cloudflare R2 stores encrypted backup copies of uploaded files — photographs, generated Reports, firm logos, signature images, and organisation documents.
- Stripe processes billing names, business email addresses, billing addresses, VAT numbers, and tokenised payment method details.
- Resend processes recipient email address, sender, subject, message content (including any report PDF attachment), and delivery metadata.
- Ideal Postcodes processes the postcode or partial address entered for a property lookup.
- Sentry processes error events, performance traces, and incidental metadata (including IP address at ingest) captured at the point of error.
- Loom processes the IP address and browser/device information of users who play an embedded help video.
- ipify processes the end user’s public IP address at the point of recording acceptance of our legal terms.
- Plausible processes aggregated, non-identifying page-view metrics only.
- Microsoft 365 processes email content, headers, and attachments sent to or from SiteWrite business mailboxes.
- Slack and monday.com process only the Personal Data that internally appears in messages or tasks; we do not push customer records, payment data, or report content into these tools.
4. How we notify changes
4.1
We give at least 14 days’ prior notice before adding or replacing a sub-processor that processes Customer Data. Notice is given by updating this page and, where the customer has subscribed to such notifications, by email to the account administrator.
4.2
Customers may object to a new sub-processor on reasonable data protection grounds within the 14-day notice period, as set out in clause 4.3 of the DPA.
4.3
To subscribe to sub-processor change notifications, or for any other question about this page, email hello@sitewrite.ai.
5. Browser features and services we do not treat as sub-processors
5.1
Voice dictation (browser Web Speech API). Where an Authorised User uses voice dictation in a supported browser (for example, Google Chrome), the browser captures the user’s audio and sends it to the browser vendor’s speech-recognition service (in Chrome’s case, Google LLC, United States), which returns transcribed text. This is a feature of the user’s browser rather than a service SiteWrite engages under an agreement. Users who do not wish audio to be processed in this way should not use voice dictation.
5.2
Google Fonts. When a report PDF is generated, the server fetches font files from Google Fonts (Google LLC, United States). This request is made by our server and does not transmit end-user or Customer Personal Data.
5.3
GitHub (source hosting and backup automation). Our source code is hosted with GitHub, Inc. (United States), and a scheduled GitHub Actions job runs our off-site file-backup process. We do not store survey content or report data in GitHub itself.
6. Version history
- v1.2 — 15 June 2026 — confirmed processing regions: Vercel functions in the United States (iad1), Cloudflare R2 in Western Europe (EEA), and Sentry in the European Union; removed the interim region-confirmation notes.
- v1.1 — 15 June 2026 — added Cloudflare R2, Ideal Postcodes, Loom and ipify; added section 5 (browser/device features and non-sub-processor services).
- v1.0 — 9 May 2026 — initial publication.