Sub-processors and delivery locations
These are the third parties that may process personal data on our clients' behalf, and the places our delivery team works from. Which ones apply to you depends on the services in your Statement of Work. We give clients at least 30 days' notice of changes by updating this page and emailing the client contact named in their Statement of Work (clause 10.6 of our Master Services Agreement).
Sub-processors
| Sub-processor | What they do | Service Profiles | Where data is processed | Transfer safeguard |
|---|---|---|---|---|
| Google (Google Workspace) | Email, document storage and collaboration | All | UK, EEA and USA | UK Extension to the EU-US Data Privacy Framework and Google's data processing terms |
| Anthropic (Claude API) | AI language model processing | A1 to A5; A6 only with client approval | USA | UK transfer safeguards in Anthropic's data processing terms |
| Twilio | Voice, SMS and WhatsApp messaging | A2, A5 | USA and EEA | UK transfer safeguards and binding corporate rules in Twilio's data protection terms |
| Meta Platforms (WhatsApp Business Platform) | WhatsApp message delivery | A5 | USA and EEA | Per WhatsApp Business terms |
| ElevenLabs | Text-to-speech and voice production | A3, A5 | USA and EEA | UK transfer safeguards in ElevenLabs' data processing terms |
| Railway | Application hosting for the Neos System and AI agents | A2, A4, A5 | EEA | UK adequacy regulations (EEA) |
| Zendesk | Helpdesk and ticketing platform | A2, A4 | EEA | UK adequacy regulations (EEA); UK transfer safeguards in Zendesk's data processing terms for any support access from outside the UK and EEA |
| Gorgias | Helpdesk platform for e-commerce support | A2, A4 | EEA | UK adequacy regulations (EEA); UK transfer safeguards in Gorgias' data processing terms for any support access from outside the UK and EEA |
| Intercom | Messaging, chat and helpdesk platform | A2, A4, A5 | EEA | UK adequacy regulations (EEA); UK transfer safeguards in Intercom's data processing terms for any support access from outside the UK and EEA |
| Make (Celonis) | Workflow automation | A4, A5 | EEA | UK adequacy regulations (EEA) |
| Cloudflare | Network security and performance | A4 | Global | UK transfer safeguards in Cloudflare's data processing terms |
Delivery locations
Our delivery team works from the United Kingdom, the European Economic Area, Japan, Bosnia and Brazil. Access from outside the UK and EEA is covered by the UK International Data Transfer Agreement or UK Addendum. Health and care work (Service Profile A6) is delivered from the UK and EEA only.