Service Provider & Subprocessor List
The active product processor chain, controller-path service providers, potential integrations and independent business partners.
Version 1.3 · effective 28 July 2026
- Owner
- Obedience Global Ltd board
- Approved by
- Obedience Global Ltd board
- Approval date
- 28 July 2026
- Next review
- 28 October 2026
01How to read this register
A provider is a subprocessor only when it processes personal data on our behalf while we are acting as a processor for a customer. When Obedience decides the purpose, such as account security or optional site analytics, Obedience is the controller and the provider is normally our processor. An installed dependency, intended partner or available integration is not proof of current processing.
We keep the active lists current. We give account holders at least 14 days' notice before a material new subprocessor handles customer workspace data, with a reasonable data-protection objection route.
02Active product processor chain
| Service | Purpose and role | Location and safeguard |
|---|---|---|
| Neon (Postgres) | Primary structured database; processor or subprocessor according to Obedience's role | Current product project reports United Kingdom, AWS London; account and contract evidence is reviewed internally |
| Cloudflare (R2, DNS, network and email routing) | File objects, encrypted backups, network delivery and routing; processor or subprocessor by data path | R2 bucket reports Western Europe automatic location; global network; Cloudflare DPA and applicable UK transfer terms |
| Vercel | Global and Quantify application hosting and edge delivery; processor or subprocessor by data path | US provider and edge network; DPA, SCCs and UK transfer terms for covered plans |
| Hetzner | Obedience Cloud server infrastructure; processor or subprocessor by data path | Germany, EEA; account DPA must remain concluded and current |
| Clerk | Authentication, organisations, sessions and account management; processor or subprocessor for service identity data and independent controller for its account information | US provider and subprocessors; DPA with SCC modules and UK terms |
| Resend | Transactional and service email when the configured email path is used | US provider; DPA, UK Extension to the EU-US Data Privacy Framework and SCC modules |
| Sentry | Quantify error and performance telemetry when configured; session replay is disabled and the app removes user email and IP fields before sending | US provider or configured service region; DPA, SCCs and UK Addendum; exact account retention and region remain controlled evidence |
03Obedience-controller service paths
These providers can process personal data for purposes Obedience determines. They are not automatically subprocessors of a customer workspace.
| Service | Purpose | Location & safeguard |
|---|---|---|
| Anthropic commercial API | Current low-sensitivity public product and policy assistant questions; no approved customer-document path | US storage by default and global processing; commercial DPA/SCCs; standard API deletion ordinarily within 30 days, subject to stated exceptions |
| Upstash Redis | Pseudonymous public-assistant and application abuse-rate counters | Provider-selected database regions; exact Obedience account region, DPA and retention evidence remain an internal gate |
| PostHog EU Cloud | Consent-gated Quantify product analytics only after Allow; withdrawal clears product analytics state | EEA endpoint, Frankfurt; DPA and account evidence remain subject to review |
04Available but not approved for private processing
Quantify contains optional OpenAI structured-output and embedding integrations. OpenAI is not part of the current approved confidential, tenant, licensed, support-ticket or professional-source processing boundary. A credential, dependency or feature flag does not change that decision. A separate DPIA, source-licence decision, DPA and transfer evidence, minimisation design, deletion exercise and accountable approval are required first.
Custom AI proxy destinations are also unapproved until separately identified, contracted, assessed and added to this register.
05Independent business partners
The following relationships are business-partner workstreams, not customer-workspace subprocessors merely because they support the company. Each partner determines material purposes required for its own regulated or company-service activity and publishes its own privacy terms.
| Partner | Relationship | Data role |
|---|---|---|
| 1st Formations | Registration and company-services partner; incorporation and address-service handling confirmed | Independent controller for personal data submitted to its formation and company-services processes |
| Starling | Intended banking partner; referral initiated, account opening not represented as complete | Independent regulated controller for application, identity, fraud, legal and banking processing; processor terms can apply only to specific additional services |
| Hiscox | Intended insurance partner; referral initiated, cover not represented as bound | Independent controller for quote, underwriting, fraud, claims, legal and policy administration processing |
| Stripe | Potential payment-services provider when activated | Controller and/or processor depending on the specific payment function and applicable terms; Obedience does not treat payment-card processing as a plain workspace subprocessor |