Sub-processors
The service providers that process your organisation's data on our behalf, and how we tell you before anything changes.
When your organisation uses SupplierVault, we are your processor. We use the sub-processors below to run the service. Each one is bound by a written contract with data protection terms, and we only share what each one needs to do its job.
Current sub-processors
| Company | What it does for us | Where the data is held |
|---|---|---|
| Supabase | Database, sign-in and file storage: your records, documents you upload, the audit trail and your team's accounts. | London, UK |
| Resend | Sends our emails: invitations, account emails and email reminders. It receives the recipient's email address and the email's content. | EU (Ireland) |
| Cloudflare | Delivers the website and app quickly and securely. Requests pass through its network, but it doesn't store your records. | Global network |
| Anthropic | Provides the optional AI assistant and the contract and invoice readers. It only receives a question, and the records the person asking can see, when someone uses them. It doesn't use your data to train its models. Organisations can switch the assistant off. | United States, with UK transfer safeguards |
Where data is processed outside the UK, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement or Addendum.
Services we look things up from
Some checks look up public information on official services. These aren't sub-processors: we only send the details needed for the search, such as a company name or number, and never your other records.
- Companies House, for company details and monitoring
- The UK Sanctions List, published by the government, for sanctions screening
- The government's Modern Slavery statement registry
- The European Central Bank, for its daily exchange rates. Nothing about you or your records is sent: we simply download the published rates.
Our website, app and supplier portal load fonts from Google Fonts, and the app and supplier pages load their sign-in and database code library from jsDelivr. Both see visitors' IP addresses. Neither receives customer data. See our privacy notice.
Changes to this list
- We'll tell you at least 30 days before we add or replace a sub-processor, by email to your organisation's admins and by updating this page.
- You have the right to object. If you have a reasonable data protection concern about a new sub-processor, email hello@suppliervault.co.uk within those 30 days. We'll work with you to address it, and if we can't, you can end your subscription before the change takes effect.
- If we ever have to make an urgent change, for example because a provider stops its service, we'll tell you as soon as we can and explain why.
Questions
Our data processing agreement sets out our duties as your processor. For any question about how your data is handled, email hello@suppliervault.co.uk. You can also read more in the help centre: Security and your data.
Last updated: 26 October 2026.