Who else handles member data, where, and under which safeguard.
Every provider that may process your members’ data on our behalf. Data processing agreements with every one, and security reviews of every one, finish by November 2026. We give at least 30 days’ notice before adding or replacing one.
Reviewed 18 October 2026
The sub-processor register.
- In place
- Operating today.
- Not in use
- Switched off for every partner until the date shown.
| Provider | What it does | Data it handles | Location | Safeguard for EU partners | Status |
|---|---|---|---|---|---|
| SupabaseSupabase Inc.SOC 2 Type II | Database, sign-in and file storage | All member data held for your app | United States or EU, chosen per partner | Stays in the EU for EU-hosted partners; standard contractual clauses otherwise | In place |
| VercelVercel Inc.SOC 2 Type II | Application hosting | Requests passing through the app | United States or EU, chosen per partner | Standard contractual clauses | In place |
| CloudflareCloudflare Inc.SOC 2 Type II | Traffic delivery and attack protection | Network data such as IP addresses | Global edge network | Standard contractual clauses | In place |
| SightengineLegal entity to confirm | Automated photo, video and text screening | Photos, videos and message text sent for screening | France | Stays in the EU | In place |
| TwilioTwilio Inc. | Phone number verification codes | Phone numbers and code messages | United States | Standard contractual clauses | In place |
| Mailgun (Sinch)Mailgun Technologies Inc. | Transactional email | Email addresses and email content | United States | Standard contractual clauses | In place |
| Apple and GoogleApple Inc. and Google LLC | Push notifications to the apps | Device tokens and notification text | United States | Standard contractual clauses | In place |
| Have I Been PwnedLegal entity to confirm | Checks passwords and sign-up email addresses against known data breaches | Sign-up email addresses, and partial password hashes (never passwords) | Australia | Standard contractual clauses | In place |
| SentryFunctional Software Inc. | Crash and error reports (no analytics) | Technical error data | United States | Standard contractual clauses | In place |
| YotiYoti Ltd | Age estimation and ID checks | Face images and ID documents, only with written consent | United Kingdom | UK adequacy decision | Not in use · until 30 Nov 2026 |
“In place” here means the provider is in use today. Supabase, Vercel and Cloudflare hold SOC 2 Type II reports for their own services; we keep copies on file (to confirm, November 2026). Where a provider is also certified under the EU-US Data Privacy Framework we will say so after checking the public list; the standard contractual clauses apply either way. Yoti is listed now so that you have 30 days’ notice before face and ID checks can start on 30 November 2026.
30 days’ notice, before any change.
- Notice by email at least 30 days before we add or replace a sub-processor. Ask to be told.
- Every change dated in the change log.
- Reviewed before use and every year for security and data protection, with a written DPA (GDPR Article 28(2) and (4)).
- No AI model provider is used today. If a partner asks for AI-written openers, the provider is added here first, with the same notice.
Company and continuity
Who we are, who signs, and what protects you if anything goes wrong
OpenSecurity controls
Every control with its status, mapped to ISO/IEC 27001 and BSI C5
OpenPrivacy and data transfers
Our role as processor, sensitive data, retention and transfers
OpenAge checks and biometric data
How age and ID checks will work, and why none run until 30 November
OpenModeration and online safety
Reports, decisions, appeals and the DSA and Online Safety Act duties
OpenAI register
Every AI system on the platform, its status and how the AI Act treats it
OpenIncidents
Our notice times, set against your own legal deadlines
OpenLaws register
Every law we build for, with its official text and who carries each duty
OpenQuestions for our security or privacy team? security@highintentmedia.com and privacy@highintentmedia.com. Or request the security pack.