> Sub-processors | Trust Center | Dating API: https://www.datingapi.io/trust/subprocessors

[Trust Center](https://www.datingapi.io/trust) / Sub-processors

# Who else handles member data, where, and under which safeguard.

Every provider that may process your members’ data on our behalf. Data processing agreements with every one, and security reviews of every one, finish by November 2026. We give at least 30 days’ notice before adding or replacing one.

[Get change notices](https://www.datingapi.io/trust#request)

Reviewed 18 October 2026

-   [Overview](https://www.datingapi.io/trust)
-   [Company](https://www.datingapi.io/trust/company)
-   [Security](https://www.datingapi.io/trust/security)
-   [Privacy](https://www.datingapi.io/trust/privacy)
-   [Sub-processors](https://www.datingapi.io/trust/subprocessors)
-   [Age checks](https://www.datingapi.io/trust/age-and-identity)
-   [Online safety](https://www.datingapi.io/trust/online-safety)
-   [AI](https://www.datingapi.io/trust/ai)
-   [Incidents](https://www.datingapi.io/trust/incidents)
-   [Laws](https://www.datingapi.io/trust/laws)

Register · 18 October 2026

## The sub-processor register.

In place

Operating today.

Not in use

Switched off for every partner until the date shown.

| Provider | What it does | Data it handles | Location | Safeguard for EU partners | Status |
| --- | --- | --- | --- | --- | --- |
| **Supabase** Supabase Inc. SOC 2 Type II | Database, sign-in and file storage | All member data held for your app | United States or EU, chosen per partner | Stays in the EU for EU-hosted partners; standard contractual clauses otherwise | In place |
| **Vercel** Vercel Inc. SOC 2 Type II | Application hosting | Requests passing through the app | United States or EU, chosen per partner | Standard contractual clauses | In place |
| **Cloudflare** Cloudflare Inc. SOC 2 Type II | Traffic delivery and attack protection | Network data such as IP addresses | Global edge network | Standard contractual clauses | In place |
| **Sightengine** Legal entity to confirm | Automated photo, video and text screening | Photos, videos and message text sent for screening | France | Stays in the EU | In place |
| **Twilio** Twilio Inc. | Phone number verification codes | Phone numbers and code messages | United States | Standard contractual clauses | In place |
| **Mailgun (Sinch)** Mailgun Technologies Inc. | Transactional email | Email addresses and email content | United States | Standard contractual clauses | In place |
| **Apple and Google** Apple Inc. and Google LLC | Push notifications to the apps | Device tokens and notification text | United States | Standard contractual clauses | In place |
| **Have I Been Pwned** Legal entity to confirm | Checks passwords and sign-up email addresses against known data breaches | Sign-up email addresses, and partial password hashes (never passwords) | Australia | Standard contractual clauses | In place |
| **Sentry** Functional Software Inc. | Crash and error reports (no analytics) | Technical error data | United States | Standard contractual clauses | In place |
| **Yoti** Yoti Ltd | Age estimation and ID checks | Face images and ID documents, only with written consent | United Kingdom | UK adequacy decision | Not in use · until 30 Nov 2026 |

“In place” here means the provider is in use today. Supabase, Vercel and Cloudflare hold SOC 2 Type II reports for their own services; we keep copies on file (to confirm, November 2026). Where a provider is also certified under the EU-US Data Privacy Framework we will say so after checking the public list; the standard contractual clauses apply either way. Yoti is listed now so that you have 30 days’ notice before face and ID checks can start on 30 November 2026.

Changes

## 30 days’ notice, before any change.

-   **Notice by email** at least 30 days before we add or replace a sub-processor. [Ask to be told](https://www.datingapi.io/trust#request).
-   **Every change dated** in the [change log](https://www.datingapi.io/trust#changes).
-   **Reviewed before use and every year** for security and data protection, with a written DPA (GDPR Article 28(2) and (4)).
-   **No AI model provider** is used today. If a partner asks for AI-written openers, the provider is added here first, with the same notice.

More in the Trust Center

[### Company and continuity

Who we are, who signs, and what protects you if anything goes wrong

Open](https://www.datingapi.io/trust/company)[### Security controls

Every control with its status, mapped to ISO/IEC 27001 and BSI C5

Open](https://www.datingapi.io/trust/security)[### Privacy and data transfers

Our role as processor, sensitive data, retention and transfers

Open](https://www.datingapi.io/trust/privacy)[### Age checks and biometric data

How age and ID checks will work, and why none run until 30 November

Open](https://www.datingapi.io/trust/age-and-identity)[### Moderation and online safety

Reports, decisions, appeals and the DSA and Online Safety Act duties

Open](https://www.datingapi.io/trust/online-safety)[### AI register

Every AI system on the platform, its status and how the AI Act treats it

Open](https://www.datingapi.io/trust/ai)[### Incidents

Our notice times, set against your own legal deadlines

Open](https://www.datingapi.io/trust/incidents)[### Laws register

Every law we build for, with its official text and who carries each duty

Open](https://www.datingapi.io/trust/laws)

Questions for our security or privacy team? [security@highintentmedia.com](mailto:security@highintentmedia.com) and [privacy@highintentmedia.com](mailto:privacy@highintentmedia.com). Or [request the security pack](https://www.datingapi.io/trust#request).