Sub-Processors
Deputise Ltd
Last updated: 17 October 2026
These companies process personal data on our behalf to run the Service. Each is bound by a data processing agreement and has been assessed for its security measures.
| Sub-processor | What it does for us | Where data is processed | Website |
|---|---|---|---|
| Cloudflare, Inc. | Hosts the application, stores sign-in sessions and chat and support pictures, checks that registrations are not bots (Turnstile), signs our staff in to admin tools (Access), keeps request logs for 7 days, and routes every AI request to the AI providers below through its AI Gateway | Global network; UK, EU and US | cloudflare.com |
| Neon, Inc. | Database | UK (London) | neon.tech |
| Resend | Sends sign-in links, invitations, escalation notices and other service email | [OWNER TO CONFIRM: region set in the Resend account] | resend.com |
| Expo | Delivers push notifications to the mobile app and holds device push tokens | US | expo.dev |
| PostHog, Inc. | Product analytics and crash reports | EU | posthog.com |
| OpenAI | Generates assistants' answers and the setup chat, and performs web search where an assistant has that capability | US | openai.com |
| Anthropic, PBC | Recognises products and researches them, including web search and page retrieval, for assistants that work with products | US | anthropic.com |
The "Where data is processed" column says where personal data is handled, not where the company is incorporated.
OpenAI and Anthropic are reached through Cloudflare's AI Gateway. [OWNER TO CONFIRM: whether the provider accounts are held by Deputise or supplied through Cloudflare's unified billing, and which data processing terms apply in each case.]
Sign-in with Google and Google's AI models are supported by our software but switched off. If we switch either on we will add Google LLC to this list with the notice described below.
Stripe
Paid plans and credit packs are sold through Stripe, which acts as merchant of record and is the controller of the payment data it collects, under its own privacy policy. Stripe processes that data in the US and elsewhere. We receive your email address, a customer reference and the status of your plan and payments.
International transfers
Where a sub-processor processes personal data outside the UK or the EEA, the transfer is covered by an adequacy decision, by the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, or by the UK International Data Transfer Agreement or Addendum and, for EEA data, the EU Standard Contractual Clauses. Our privacy policy has more on transfers.
Changes
We update this page and the date at the top when a sub-processor is added, replaced or its role changes materially. Customers under our data processing agreement receive at least 30 days' notice by email before a new or replacement sub-processor handles their data, and may object within that period by writing to privacy@deputise.ai.
Contact
Questions about sub-processors: privacy@deputise.ai