Subprocessor List
Draft for solicitor and privacy review before production use. Last updated 8 October 2026.
Status
Configuration disclosure for legal review. Confirm exact contracting entities, agreements, hosting regions and international-transfer safeguards before processing live customer data.
ChatGPT Sites / OpenAI
Hosting control plane and current account sign-in. The application uses Sites-provided identity; independent Entra, Google Workspace and SAML sign-in are not configured.
Cloudflare
Worker execution, D1 relational storage and R2 evidence object storage through ChatGPT Sites. Provider-managed encryption and residency commitments must be checked against the platform agreement; no independent UK-only hosting guarantee is made here.
OpenAI API — optional
Structured operational recommendations when a server-side API key and tenant allowance are configured. Operational records supplied to the model are untrusted evidence, not instructions. AI is not enabled merely because the application is hosted through Sites.
Stripe — optional
Hosted subscription checkout, invoicing and billing portal when configured. Payment-card entry occurs on Stripe-hosted pages. Operational customer charge approvals do not take payments.
Resend — optional
Transactional billing email and customer mailbox verification when configured. A provider accepting an email is not proof it arrived in the recipient’s inbox.
Additional integrations
No connected Xero, Sage, QuickBooks, Outlook, Gmail, SFTP or enterprise identity providers are claimed. Review and add subprocessors before enabling them.