Sub-processors

The third parties we use to run SponsorGuard, what each one does, which personal data it can reach, where it processes that data, and the transfer mechanism we rely on.

Last updated: 3 October 2026 · Version 2026-10-03

Authorised sub-processors

This page is Annex B of our Data Processing Agreement. Every entry below is derived from the actual application and deployment configuration, not from an aspiration — where we have not yet pinned down a provider's region or legal entity, the entry says so rather than guessing.

Cloudflare, Inc.

Purpose: Object storage for uploaded evidence documents and hourly encrypted database backups (R2), plus DNS for the SponsorGuard domains.
Data they can access: Uploaded evidence documents and their object keys — which can include passport, visa, right-to-work and DBS scans. Request metadata for DNS.
Processing location: Stored files are held in Cloudflare R2 with a Western Europe location hint. This is not a contractual EU-only guarantee.
Transfer mechanism: Cloudflare's Data Processing Addendum incorporating the EU Standard Contractual Clauses with the UK Addendum.

Anthropic, PBC

Purpose: AI-assisted document extraction, audit-pack narrative summaries, and CortexAI answers. Every output is routed for authorised human review.
Data they can access: The text of documents submitted for extraction and the text of questions asked in CortexAI, together with the compliance context needed to answer them.
Processing location: United States.
Transfer mechanism: Anthropic's Data Processing Addendum incorporating the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

Postmark (ActiveCampaign, LLC)

Purpose: Transactional email delivery — account verification, password reset, worker-portal invitations and reminder digests.
Data they can access: Recipient email address and name, and notification contents. No passport, visa or DBS data is placed in emails.
Processing location: United States.
Transfer mechanism: Postmark's Data Processing Addendum incorporating the EU Standard Contractual Clauses with the UK Addendum.

Stripe Payments UK Ltd

Purpose: Subscription billing and payment processing after a trial or pilot converts to a paid plan. No card details are stored on SponsorGuard systems.
Data they can access: Billing contact name and email, subscription plan and payment metadata. No sponsored-worker data.
Processing location: United Kingdom.
Transfer mechanism: UK processing; no restricted transfer.

Google Analytics 4 (Google Ireland Limited)

Purpose: Optional website analytics on public marketing pages only, loaded solely after the visitor opts in to analytics cookies. No analytics runs in the signed-in application, authentication pages, worker portal or platform administration, even with prior public-page consent.
Data they can access: Website usage events, approximate location and device/browser data. No sponsored-worker data and no account identifiers are sent.
Processing location: Google may process personal data in any country where Google or its subprocessors maintain facilities.
Transfer mechanism: Google Ads Data Processing Terms, Appendix 3A: EU Standard Contractual Clauses with the UK Addendum, or an applicable adequacy decision or alternative transfer solution, as provided in those terms.

Hetzner Online GmbH

Purpose: Running the SponsorGuard application, its PostgreSQL database and its Redis instance.
Data they can access: All personal data held in the SponsorGuard record — identity, immigration, employment, pay and compliance evidence metadata — plus account and audit data.
Processing location: Provider based in Germany; servers in Helsinki, Finland (EU).
Transfer mechanism: EU processing under UK adequacy regulations; no restricted transfer.

Who is not on this list

Providers you might expect to see, and why they are absent:

Clay and Smartlead — used only for SponsorGuard's own outbound sales prospecting, where SponsorGuard is the controller of business-contact data. They receive no customer workspace data and no sponsored-worker data.

How we tell you about changes

You give general authorisation for the sub-processors above when you accept the Terms of Service. We will email the account owner at least 30 days before we add or replace one, which gives you time to object on reasonable data-protection grounds. If you object and we cannot resolve it, you can terminate the affected part of the service without penalty.

Ask us anything about this list at privacy@sponsorguard.com.