Sub-processors
Third parties we engage to deliver Closewise, and where each one keeps data.
Every party listed here is engaged as a sub-processor under Art. 28(4) GDPR, bound by data protection obligations no less protective than those in our own data processing agreement. We remain fully liable to you for their performance.
Notice and objection
Our AVV grants a general authorisation for the sub-processors on this page. Before we add or replace one, we will notify you at least 30 days in advance by email to your registered address. You may object on reasonable data protection grounds within that period; if we cannot accommodate the objection, you may terminate the affected services without penalty.
To be notified of changes, or to object, write to our contact address.
Current sub-processors
Railway
- Entity
- Railway Corp., United States
- Purpose
- Application hosting and runtime logs
- Data categories
- Account data, request metadata, IP addresses, and any personal data present in an imported file while it is being processed in memory
- Location
- EU region (Amsterdam) where selected; control plane in the US
- Transfer basis
- Standard Contractual Clauses, supported by the EU-US Data Privacy Framework where the entity is certified
- Their DPA
- https://railway.com/legal/dpa
Supabase
- Entity
- Supabase, Inc., United States
- Purpose
- Managed PostgreSQL database and backups
- Data categories
- Account data (name, business email, company, telephone, job role), password hashes, verification and reset token hashes, import metadata
- Location
- eu-west-1 (Ireland)
- Transfer basis
- Data at rest stays in the EU. Standard Contractual Clauses cover support access from outside the EEA.
- Their DPA
- https://supabase.com/legal/dpa
Resend
- Entity
- Resend, Inc., United States
- Purpose
- Transactional email (address verification, password reset)
- Data categories
- Recipient email address and name, delivery metadata
- Location
- United States, with an EU region available
- Transfer basis
- Standard Contractual Clauses, supported by the EU-US Data Privacy Framework where the entity is certified
- Their DPA
- https://resend.com/legal/dpa
Cloudflare
- Entity
- Cloudflare, Inc., United States
- Purpose
- Turnstile bot protection on the sign-up form
- Data categories
- IP address and browser characteristics of the person signing up
- Location
- Global edge network; EU data localisation available
- Transfer basis
- Standard Contractual Clauses, supported by the EU-US Data Privacy Framework where the entity is certified
- Their DPA
- https://www.cloudflare.com/cloudflare-customer-dpa/
Transfers outside the EEA
The database that holds account data runs in the European Union (eu-west-1, Ireland). Several providers above are US-established. Those transfers rest on the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, supported by the EU-US Data Privacy Framework adequacy decision where the recipient is certified.
We treat the Standard Contractual Clauses as the load-bearing mechanism rather than relying on the adequacy decision alone. The decision is in force, but an appeal is pending before the Court of Justice of the European Union (C-703/25 P), and the Court invalidated both predecessor frameworks. Keeping the clauses in place means an annulment would not by itself make our transfers unlawful.