1.Current sub-processors
| Sub-processor | Purpose | Region | Safeguard |
|---|---|---|---|
| Supabase Supabase, Inc. | Application database, authentication, file storage | European Union (Frankfurt) | DPA + EU Standard Contractual Clauses with UK Addendum |
| Vercel Vercel Inc. | Application hosting, edge network, serverless compute | Global edge with EU primary | DPA + EU Standard Contractual Clauses with UK Addendum |
| Anthropic Anthropic, PBC | AI inference for the Recon analyst (Claude models) | EU regions where supported, otherwise US | DPA + EU Standard Contractual Clauses with UK Addendum |
| Inngest Inngest, Inc. | Background job orchestration | European Union | DPA + EU Standard Contractual Clauses with UK Addendum |
| Sentry Functional Software, Inc. (DBA Sentry) | Error monitoring and crash reporting | European Union (de.sentry.io) | DPA + EU Standard Contractual Clauses with UK Addendum |
| PostHog PostHog, Inc. | Product analytics | European Union (eu.i.posthog.com) | DPA + EU Standard Contractual Clauses with UK Addendum |
| Resend Resend, Inc. | Transactional email delivery | European Union | DPA + EU Standard Contractual Clauses with UK Addendum |
| HubSpot HubSpot, Inc. (when authorized by Customer) | CRM data source connected by the Customer under the Customer’s own portal | Customer-controlled | Customer’s direct relationship with HubSpot |
2.How we notify changes
We will notify Customers by email and update this page at least 30 days before adding, replacing, or materially changing the role of any sub-processor that processes personal data on the Customer’s behalf. The notice period is reduced to such period as is reasonable in the circumstances if a change is required for urgent security, regulatory, or operational reasons, in which case we will explain the reason in the notice.
3.Objection rights
A Customer may object to a new or replacement sub-processor on reasonable grounds relating to data protection by writing to hello@alpndigital.com within the notice period. We will work with the Customer in good faith to resolve the objection, which may include continuing to provide the service without the new sub-processor where commercially reasonable. If the parties cannot reach resolution within a reasonable period, the Customer may terminate the affected service for material breach as set out in the Terms of Service.
4.Onward transfers and safeguards
Where a sub-processor is located outside the United Kingdom or European Economic Area, transfers are made under one of the safeguards in Article 46 of the UK GDPR, including (as relevant) the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy regulation. Supplementary technical and organizational measures are applied where required by our transfer impact assessments.
5.Contact
For DPA copies, transfer impact assessments, or sub-processor due diligence materials, contact hello@alpndigital.com.