Sub-processor List

1. About this list

1.1 This list names the third parties that CERTSYNC LIMITED (“CertSync”) engages to process Personal Data, as Article 28(2) and Article 13(1)(e) of the UK GDPR require.

1.2 This list is Schedule 1 to the Data Processing Agreement (the “DPA”) at /dpa. It is the Sub-processor list the Privacy Notice refers to.

1.3 The list is current at its Last updated date. CertSync reviews it whenever a Sub-processor is added, removed or materially changed, and at least once a year.

2. CertSync's role

2.1 CertSync is a controller for Account Data, Audit and Security Data, Payment Metadata, and Cookie, Analytics and Attribution Data.

2.2 CertSync is a processor for Certificate Content and Cross-Certificate Memory. Each Customer is the controller of that data and CertSync acts on the Customer's instructions under the DPA.

2.3 Each Sub-processor in section 3 acts as a processor for CertSync, in whichever of those roles applies. The recipients in section 4 are not Sub-processors, and are listed so that every party that receives Personal Data is disclosed.

3. Sub-processors

3.1 MongoDB Atlas (primary database)

Legal entity	MongoDB, Inc., Delaware, United States.
Service	Cloud database. All Personal Data CertSync holds is stored here, together with its encrypted backups.
Personal Data categories	All categories: Account Data, Certificate Content, Cross-Certificate Memory, Payment Metadata, Audit and Security Data, Communications Data and session identifiers.
Country of processing	United Kingdom (London region).
UK transfer basis	None needed. The data stays in the United Kingdom.
DPA	MongoDB Data Processing Agreement (mongodb.com/legal/dpa).

3.2 Vercel (hosting, file storage and site analytics)

Legal entity	Vercel, Inc., Delaware, United States.
Service	Application hosting and serverless functions; file storage (Vercel Blob) for certificate PDFs, photographs, company logos and backup archives; and, only where a visitor has consented to analytics cookies, Vercel Analytics and Speed Insights.
Personal Data categories	Request data (IP address, browser details, request headers); Audit and Security Data; stored files containing Certificate Content; for analytics, page views and performance measurements linked to a hashed visitor identifier.
Country of processing	United Kingdom and European Union regions for serving requests; United Kingdom (London, LHR1) for files stored in Vercel Blob; United States for Vercel’s control plane.
UK transfer basis	UK-US Data Bridge where Vercel’s certification covers the transfer, with the UK Addendum to the EU Standard Contractual Clauses as a fallback.
DPA	Vercel Data Processing Addendum (vercel.com/legal/dpa).

3.3 Upstash (rate limiting and sign-in security)

Legal entity	Upstash, Inc., Delaware, United States, provided through the Vercel Marketplace.
Service	In-memory store for rate-limit counters, revoked sign-in tokens, multi-factor challenge and step-up tokens, and security-alert cooldowns. It also holds the AI board scan retry record for 24 hours after a scan is delivered, so that a free retry re-reads only the ways the scan missed, from the same photographs.
Personal Data categories	IP addresses (as rate-limit keys), sign-in token identifiers, and hashes of multi-factor and step-up tokens. For the AI board scan retry record: a one-way hash of each photograph, the number of ways and way numbers the scan found, and the board details it read, which can include text read from the board’s labels. No photograph is held, and the record is deleted automatically after 24 hours.
Country of processing	The cloud region chosen for CertSync’s Upstash database, with support access by Upstash, Inc. from the United States.
UK transfer basis	UK Addendum to the EU Standard Contractual Clauses, in the Upstash Data Processing Addendum.
DPA	Upstash Data Processing Addendum (upstash.com/trust/dpa.pdf). Upstash is bought through the Vercel Marketplace, but its own terms apply, not Vercel’s.

3.4 Stripe (payments)

Legal entity	The Stripe group company that provides payment services to CertSync, with processing by Stripe, Inc., Delaware, United States.
Service	Payment processing, subscriptions, invoices and the Stripe-hosted checkout.
Personal Data categories	Customer name and email address, Stripe customer identifier, CertSync user identifier, plan and billing interval, and invoice records. Card and bank details go to Stripe only and never reach CertSync.
Country of processing	United States and other Stripe locations.
UK transfer basis	UK-US Data Bridge, with the UK Addendum to the EU Standard Contractual Clauses as a fallback.
DPA	Stripe Data Processing Agreement (stripe.com/legal/dpa).
Note	Stripe is an independent controller for card details and card-transaction records, under its own privacy policy. CertSync cannot make Stripe delete data it holds as controller.

3.5 Resend (email)

Legal entity	Resend, Inc., Delaware, United States.
Service	Delivery of the emails the Service sends, including sign-in codes, password resets, account and billing messages, certificate delivery and deletion warnings.
Personal Data categories	Recipient email address, email content (including one-time sign-in codes) and delivery status.
Country of processing	United States.
UK transfer basis	UK Addendum to the EU Standard Contractual Clauses.
DPA	Resend Data Processing Agreement (resend.com/legal/dpa).

3.6 Sentry (error monitoring, website and mobile apps)

Legal entity	Functional Software, Inc., trading as Sentry, Delaware, United States.
Service	Error monitoring and performance tracing on every page of the website and in the CertSync mobile apps. On the website only, and only where the user has consented to analytics cookies, Sentry Session Replay records dashboard pages with all text and form inputs masked and all media blocked. The mobile apps do not use Session Replay.
Personal Data categories	Error details, stack traces and request data, which may include an IP address and a CertSync user identifier.
Country of processing	European Union (Germany). CertSync’s Sentry account uses Sentry’s EU data region.
UK transfer basis	UK adequacy regulations for the EEA for the stored data. Any remote access by Sentry from the United States is covered by the UK-US Data Bridge, with the UK Addendum to the EU Standard Contractual Clauses as a fallback.
DPA	Sentry Data Processing Addendum (sentry.io/legal/dpa).

3.7 Google Analytics 4 (website analytics)

Legal entity	Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with processing by Google LLC and its affiliates.
Service	Measurement of website use. Runs only where the visitor has consented to analytics cookies; nothing is loaded before that consent. Not used in the mobile apps.
Personal Data categories	Cookie identifiers (see Cookie Policy clause 3.3), page views and events, and device, browser and referrer details. Google uses the IP address to estimate a rough location and does not store it.
Country of processing	United States and other Google locations.
Configuration	Google Signals and ad personalisation are switched off. The data is not used for advertising and is not linked to any CertSync account.
UK transfer basis	Google Ads Data Processing Terms, which include the EU Standard Contractual Clauses with the UK Addendum.
DPA	Google Ads Data Processing Terms.

3.8 Google Firebase Cloud Messaging (mobile app notifications)

CertSync sends mobile app notifications through Firebase Cloud Messaging. Google can read their content, so every notification is generic: its title is always “CertSync” and its text is a fixed sentence that names only the kind of event, such as “A certificate is ready for approval.” It never contains a certificate number, a customer or site name, an address, or a person's name. The details load inside the app after the user opens it.

Legal entity	Google (Firebase).
Service	Delivery of notifications to the CertSync app on Android, and hand-over of iPhone and iPad notifications to Apple (clause 4.3). Used only for a device on which the user has allowed notifications.
Personal Data categories	The device token Firebase assigns to the app; the generic notification text; an in-app link made of internal record identifiers; a notification category; the unread count; and the timing of notifications. No account identifier, email address, name, certificate number, Certificate Content, customer record or site address is sent.
Country of processing	United States and other Google locations.
UK transfer basis	The UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge), on which the Firebase Data Processing and Security Terms rely for transfers from the United Kingdom.
DPA	Firebase Data Processing and Security Terms, which are incorporated into the Firebase terms that govern CertSync’s use of Firebase.

3.9 Google Cloud (Vertex AI) — AI-Assisted Suggestions

Legal entity	Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, the Google contracting entity for Google Cloud customers in the United Kingdom, with onward processing by its own sub-processors as set out in the Google Cloud Data Processing Addendum.
Service	Google Cloud Vertex AI, a generative-artificial-intelligence service. CertSync uses one of two large-language models on it: Google Gemini or Anthropic Claude, both used through Google Vertex AI. It is used only for CertSync’s AI-assisted features: reading a photograph of a distribution board to suggest circuit details (AI board scan), suggesting observation wording for an electrical installation condition report from the notes the Authorised User submits (AI observation suggestions), and any further AI-assisted feature CertSync offers, such as reading a photograph of a meter, cut-out, equipment rating plate, instrument display or defect, drafting a certificate summary, or answering a question about a published standard. A request is sent only when an Authorised User starts one of those features, only for the item they select, and never as a background or bulk operation. If one model does not answer, the same request, with the same data, may be sent to the other; a model is never used to check or compare another model’s answer. The service returns suggestions only; the Authorised User reviews every suggestion before anything is written to a certificate. CertSync uses the Claude model through its Google Cloud account under the Google Cloud terms and sends no data to Anthropic directly.
Personal Data categories	For an AI board scan: the photograph the Authorised User takes or selects, which may incidentally show a person or the interior of a property. For AI observation suggestions: the inspector’s notes and the observation context the Authorised User submits, with UK postcodes and email addresses removed before the request is sent. CertSync does not send the client’s name, address, postcode or contact details with either request, but a name or street address typed into the notes, or visible in a photograph, will be included. For any further AI-assisted feature CertSync offers: the photograph, note or question the Authorised User selects or types for that request and, for a certificate summary, the certificate’s observations, test readings and condition sections, without the client’s name, address or contact details, the names of the inspector and signatories, or the certificate number. Speech used to enter readings, where offered, is not sent. No account credential or payment detail is sent.
Country and region of processing	The European Union, for the endpoint CertSync sends requests to (the Google Cloud Vertex AI “eu” multi-region). Requests to the Gemini model are sent only to the aiplatform.eu.rep.googleapis.com endpoint, and requests to the Claude model only to the aiplatform.eu.rep.googleapis.com endpoint for the Vertex AI “eu” location, which is also in the European Union. CertSync’s code refuses to send a request to any other location, including Google’s global endpoint. Choosing these endpoints is what CertSync controls. Google states that processing on that endpoint stays in the European Union for the models it lists; for the Claude model, CertSync is awaiting Google’s written confirmation that its processing stays inside that region. No request is sent to an endpoint in the United Kingdom.
Model training and retention	Google’s Vertex AI terms state that Google will not use customer data to train or fine-tune any artificial-intelligence or machine-learning model without the customer’s prior permission or instruction, and that this applies to all managed models on Vertex AI. CertSync has given no such permission or instruction, for either model, and does not itself use the content sent to either model to train any model. The AI request itself stores no photograph. The photographs taken for an AI board scan are saved with the certificate once the scan request has been sent, even when the scan fails, and are kept and deleted with it. For 24 hours after a board scan is delivered, CertSync keeps a record that ties a free retry to that scan: a one-way hash of each photograph (no photograph can be rebuilt from it), the number of ways and way numbers the scan found and the board details it read, which can include text read from the board’s labels. Apart from that, CertSync does not store the notes sent or the response after the request. Google may keep prompts that its systems flag for possible abuse for up to 90 days for Google models such as Gemini, or up to 30 days for the Claude model, for which Google says all prompts and responses may be logged; authorised Google staff may review them. Google’s request cache is switched off for CertSync’s project.
Safeguards	Requests are encrypted in transit (TLS) and authenticated with a CertSync service account. Only the item the Authorised User selects is sent. CertSync’s usage record of each request holds the feature, the outcome and the credit cost, and no part of the content sent or the suggestion returned.
UK transfer basis	The contracting entity and the processing location are in the European Economic Area, which the United Kingdom recognises as adequate (clause 6.2). Any onward transfer by Google outside the European Economic Area is governed by the Google Cloud Data Processing Addendum.
DPA	Google Cloud Data Processing Addendum (Customers), incorporated into the Google Cloud terms of service.

3.10 Twilio (staff security SMS)

Legal entity	Twilio Inc., Delaware, United States.
Service	Text-message alerts to CertSync’s own security staff about critical security events. Used for staff alerts only: no text message is ever sent to a customer or user.
Personal Data categories	The staff phone numbers alerts go to, and in each alert the severity, the type of event and the first eight characters of the affected CertSync user identifier. No name, email address, certificate number, Certificate Content, customer record or site address is sent.
Country of processing	United States.
UK transfer basis	UK-US Data Bridge where Twilio’s certification covers the transfer, with the UK Addendum to the EU Standard Contractual Clauses as a fallback.
DPA	Twilio Data Protection Addendum (twilio.com/legal/data-protection-addendum).

4. Other recipients

4.1 Google Ads (sign-up conversion measurement)

Legal entity	Google Ireland Limited, Dublin, Ireland, with processing by Google LLC and its affiliates.
Role	Independent controller, under the Google Ads Controller-Controller Data Protection Terms.
What it does	Records that a sign-up followed a Google advertisement. Runs only where the visitor has consented to marketing cookies; nothing is loaded before that consent. Consent to analytics cookies does not switch it on.
Personal Data categories	Cookie identifiers (see Cookie Policy clause 3.4); one sign-up event carrying the Stripe checkout reference; IP address; page address without its query string; referrer; and device and browser details. Ad personalisation is switched off. No certificate, customer or site data, name or email address is sent.

4.2 Browser push services (website notifications)

Recipient	The push service chosen by the user’s browser, not by CertSync. For Chrome, Edge and other Chromium browsers this is Google; other browsers use their own vendor.
What it does	Relays a website notification to a browser whose user has allowed notifications. The message is encrypted (RFC 8291), so the push service cannot read it.
Personal Data categories	The push address the browser assigned, and the timing and size of each message. No account identifier, email address, name, certificate number, Certificate Content, customer record or site address is sent.
UK transfer basis	For Google, the UK-US Data Bridge. No processing agreement is available for a browser’s push service.

4.3 Apple Push Notification service (iPhone and iPad)

Legal entity	Apple Distribution International Ltd, Cork, Ireland, with processing by Apple Inc., United States.
What it does	Apple’s service is the only way to deliver a notification to an iPhone or iPad. Firebase Cloud Messaging (clause 3.8) passes each notification to Apple.
Personal Data categories	The device token Apple assigns to the app, and the same generic notification described at clause 3.8. No account identifier, email address, name, certificate number, Certificate Content, customer record or site address is sent.
UK transfer basis	CertSync’s disclosure is to Apple’s Irish company and relies on the UK adequacy regulations for the EEA (clause 6.2). Apple transfers the data on to Apple Inc. under its own Standard Contractual Clauses.

4.4 App stores

The CertSync apps are downloaded from Apple's App Store and Google Play. Apple and Google process store-account, download and update data as independent controllers under their own terms. No purchase is made in the apps.

4.5 MaxMind GeoLite2 (no data sent)

CertSync estimates the location of a sign-in from its IP address using a copy of the MaxMind GeoLite2 database held in its own storage. No IP address is sent to MaxMind, Inc., so MaxMind is not a Sub-processor.

5. Not currently engaged

5.1 The services below are not engaged and receive no data. Before any of them is used, CertSync will move it to section 3 and give notice under section 7.

5.2 Capgo (over-the-air app updates). Digital Shift OÜ, trading as Capgo (Tallinn, Estonia), may later be used to update the web layer of the mobile apps without a new store release. It would receive a random install identifier not linked to any account, app and system versions, update events, and the IP address used to deliver the update. It would receive no name, email address, account identifier or Certificate Content. Processing would take place in the EEA, using Capgo's EU endpoints.

5.3 Meta Pixel and Ideal Postcodes. The Meta Pixel (Meta Platforms Ireland Limited) and address lookup by Ideal Postcodes Ltd are switched off.

5.4 Generative-artificial-intelligence and large-language-model services. Google Cloud EMEA Limited (Google Cloud Vertex AI) is an Active Sub-processor listed at clause 3.9. CertSync does not engage Anthropic directly, or OpenAI, xAI or any other large-language-model or generative-artificial-intelligence service, as a Sub-processor at the date of this list. Google Cloud Vertex AI is the only route by which CertSync sends a request to an AI model, whether to the Claude model or to the Gemini model, and no other AI service is connected to CertSync.

6. International transfers

6.1 The primary database stays in the United Kingdom. Where a Sub-processor or recipient processes data elsewhere, the transfer meets Chapter V of the UK GDPR, as amended by the Data (Use and Access) Act 2025, using one of the mechanisms below.

6.2 Adequacy. The United Kingdom treats the European Economic Area as adequate, so no further safeguard is needed for processing there.

6.3 UK-US Data Bridge. The UK Extension to the EU-US Data Privacy Framework, in force since 12 October 2023, for recipients certified under it.

6.4 IDTA or UK Addendum. The International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, both in force since 21 March 2022.

7. Changes to this list

7.1 CertSync publishes every new or replacement Sub-processor here and updates the Last updated date. Where CertSync reasonably considers a change material, it also emails active Customers.

7.2 A Customer may object to a change as the DPA sets out, including the right to end the agreement without penalty if no alternative is agreed.

8. Contact

For questions about this list, or a copy of a transfer safeguard, email privacy@certsync.co.uk or write to CERTSYNC LIMITED at the registered office shown in the website footer.