Skip to content
← Home

Legal

Sub-processors.

Last updated · May 2026

About this list

A sub-processor is a third party that Preshift uses to help deliver its products and operate its business, where that third party may access personal data we hold. Under our Data Processing Agreement you authorise us to use the sub-processors below.

Every sub-processor is bound by a written contract that obliges them to protect your data at least to the standard we are obliged to apply ourselves under UK GDPR. The transfer-mechanism column indicates how we lawfully share data with each sub-processor when they are located outside the UK.

We will give existing customers at least thirty days' notice by email before we add a new sub-processor that materially affects the processing of your data. If you object during that period we will work with you to find an alternative; in the rare case we cannot, you may terminate the affected service.

Production sub-processors

Third parties that may access customer personal data as part of delivering Reports, Stack, or our other products.

Amazon Web Services (AWS)

United Kingdom (eu-west-2, London)

Purpose · Application hosting, database, file storage, backups. Primary production environment for Reports and Stack.

Data categories · Customer account data, operational data, contract data, AI commentary, alerts log

Transfer mechanism · UK hosting, no transfer

Vercel

Global edge network with regional control; primary processing in EU/UK

Purpose · Frontend hosting and edge functions for preshift.co.uk and the customer-facing portals.

Data categories · Website analytics, anonymised request logs

Transfer mechanism · UK adequacy + UK IDTA where applicable

Anthropic

United States

Purpose · AI inference for Reports commentary and Stack contract extraction, clause risk scoring, negotiation drafting. Operated under a zero-retention, no-training contract.

Data categories · Daily Reports metrics (no personally identifiable customer data unless explicitly opted in); Stack contract content during processing only

Transfer mechanism · UK IDTA attached to the EU Standard Contractual Clauses, plus supplementary measures (no model training, zero retention)

Resend

United States

Purpose · Transactional email delivery (daily Reports digests, Stack renewal alerts, account notifications).

Data categories · Recipient name and email, email content (Reports digest, Stack alert)

Transfer mechanism · UK IDTA + EU Standard Contractual Clauses

WhatsApp Business Platform (Meta)

Ireland and United States

Purpose · Delivery of Reports digests and Stack renewal alerts to customers who opt for WhatsApp delivery.

Data categories · Recipient phone number, message content (Reports digest, Stack alert)

Transfer mechanism · UK IDTA + EU Standard Contractual Clauses

Stripe

United Kingdom and United States

Purpose · Billing, subscription management, payment processing.

Data categories · Customer billing contact, payment method, invoice history

Transfer mechanism · UK IDTA + EU Standard Contractual Clauses for non-UK transfers

Sentry

United States

Purpose · Error monitoring and performance observability for our production applications.

Data categories · Anonymised application error events, scrubbed of personally identifiable information at source

Transfer mechanism · UK IDTA + EU Standard Contractual Clauses

Operational sub-processors

Third parties that support our internal operations and may incidentally process customer contact information (for example, business emails between us and a customer).

Google Workspace (Google Cloud EMEA Ltd)

EEA

Purpose · Internal email, calendar, document storage for the Preshift team.

Data categories · Customer business contacts, emails sent to or received from customers, supporting documents

Transfer mechanism · EU adequacy (UK)

Slack (Salesforce)

United States

Purpose · Internal team communication.

Data categories · Customer business contacts where mentioned in internal threads

Transfer mechanism · UK IDTA + EU Standard Contractual Clauses

HubSpot

United States (with EU hosting option)

Purpose · Customer relationship management for sales and customer success.

Data categories · Prospect and customer business contact details, communication history, engagement notes

Transfer mechanism · UK IDTA + EU Standard Contractual Clauses

Cal.com

European Economic Area

Purpose · Meeting scheduling.

Data categories · Meeting attendee name, email, scheduled times

Transfer mechanism · UK adequacy

Sanity

European Economic Area

Purpose · Headless CMS for the preshift.co.uk marketing website.

Data categories · No customer personal data. Marketing site content only.

Transfer mechanism · UK adequacy

Questions, notifications, or objections

Email privacy@preshift.co.uk. To receive direct notification of sub-processor changes by email, ask us to add you to the list when you sign your Data Processing Agreement.

whenever you're ready

Let's talk about your tech.

Half an hour on Zoom or in person. We'll show up with questions, not a slide deck.