What this list is
These organisations process personal data on our behalf, only on our written instructions, under contracts that require them to keep it secure and confidential and to help us meet your rights. Employers using our service can treat this as our sub-processor list. We will update this page before adding or replacing a processor that handles candidate or learner data.
| Processor | What it does for us | Personal data | Where | Safeguard | Status |
|---|---|---|---|---|---|
| Supabase | Database, sign-in (authentication) and private file storage for the platform | All platform records described in our privacy notices, uploaded documents, sign-in details | United Kingdom (London region) — [to be confirmed against the production project settings] | Data processing agreement; support access from outside the UK under the UK International Data Transfer Addendum or adequacy — [to be confirmed] | in use when configured |
| Vercel | Hosting and delivering the website and portals | Page requests, network address and browser details in transient server logs; data passing through pages you use | [to be confirmed: Vercel function region and log location] | Data processing agreement; UK International Data Transfer Addendum or UK–US data bridge where data leaves the UK — [to be confirmed] | in use when configured |
| Railway | Background worker: sending notifications, scheduled checks and automation jobs | Record references and the content of notifications being sent | [to be confirmed: Railway region] | Data processing agreement — [to be confirmed] | in use when configured |
| Stripe | Hosted card payments and refunds | Invoice reference, amount, payer email; card details are entered on Stripe's page and never reach us | [to be confirmed: Stripe entity and processing locations] | Stripe services agreement and data processing terms; Stripe is an independent controller for its own fraud-prevention and regulatory duties | in use when configured |
| Email delivery provider | Sending emails you asked for or that relate to your application, training, account or invoices, and marketing only with your consent | Name, email address, message content | [to be confirmed: provider not yet chosen — Q-024] | [to be confirmed] | not yet chosen |
| Sentry | Error monitoring so we can find and fix faults | Technical error details, page address without its query string, browser type; email addresses, phone numbers, National Insurance numbers, postcodes, names in form fields, cookies and form contents are removed before sending | [to be confirmed: EU or US data region of the Sentry organisation] | Data processing agreement; UK International Data Transfer Addendum where applicable — [to be confirmed] | in use when configured |
| Better Stack | Uptime monitoring and service logs | Service log lines with personal details removed; uptime check results | [to be confirmed: Better Stack data region] | Data processing agreement — [to be confirmed] | in use when configured |
| PostHog | Optional website analytics | A random identifier, pages visited (without query strings), clicks on links and buttons with attributes masked; no screen recording, no typed text | European Union (PostHog EU cloud) | Data processing agreement; the UK recognises the EU/EEA as adequate for transfers | only with your consent |
Independent organisations
Some organisations receive information from us as controllers in their own right, not as our processors — for example a funding body or lead provider, DVSA, an awarding body, an employer you apply to, and our payment provider for its own fraud-prevention and legal duties. Their own privacy notices apply.
Items to confirm
Where a location or safeguard shows "[to be confirmed: …]", it must be checked against the provider's signed data processing terms and our account settings before this list is published.
Change history
| Version | Date | Change | Acceptance needed again |
|---|---|---|---|
| 1.0 | First draft for legal review, written from the platform as built. | Yes — material change |