Sub-processors

Last updated: 18 June 2026

SafeGuard Workers engages the following third-party sub-processors as required by UK GDPR Article 28. Where a DPA is marked pending, the relevant agreement is in the process of being executed and will be updated here once complete.

⚠

DPA action required: Resend and Sentry and PostHog DPAs have not yet been executed. Processing continues under the providers' standard terms while DPAs are finalised.

Supabase

DPA signed

Database and authentication — stores all user data, incident reports, and files

Data shared: All personal data and special category data (incident reports, health data, immigration status)

Location: EU / US (configurable)

View DPA →

DPA accepted as part of Supabase Terms of Service

Resend

DPA pending

Transactional email — welcome emails, report confirmations, legal case notifications

Data shared: User name, email address, report reference IDs, case type

Location: United States

View DPA →

Action required: sign DPA at resend.com → Settings → Legal → DPA

Stripe

DPA auto-accepted

Payment processing for organisation subscriptions

Data shared: Organisation billing contact name, email, address, Stripe customer ID

Location: United States / EU

View DPA →

DPA auto-accepted on Stripe account creation per Stripe terms

Sentry

DPA pending

Error monitoring (session replay only with explicit analytics consent)

Data shared: Error traces, anonymised user ID, masked email. Session replay requires opt-in.

Location: United States

View DPA →

Action required: sign DPA at sentry.io → Settings → Legal → DPA

PostHog

DPA pending

Product analytics — only active after the user accepts analytics in the consent banner

Data shared: Usage events (pages viewed, features used); person profile linked only after explicit consent

Location: United States

View DPA →

Action required: execute DPA in PostHog organization settings

Vercel

DPA signed

Frontend hosting and serverless compute

Data shared: Request logs (IP addresses, URLs) — retained ≤30 days per Vercel policy

Location: EU / US (configurable)

View DPA →

DPA accepted as part of Vercel Terms of Service

Google (Maps API)

DPA auto-accepted

Police station lookup for generating police report guidance

Data shared: Location query (city/postcode only — no personally identifiable information)

Location: United States

View DPA →

Data Processing Addendum applies automatically under Google Cloud Terms

Data residency

Primary data is stored by Supabase in EU data centres where possible. For specific residency requirements contact privacy@safeguardworkers.co.uk.

To exercise your GDPR rights, visit Account Settings or email privacy@safeguardworkers.co.uk.