Important Notice
We will notify users of any changes to this list at least 30 days before adding a new sub-processor. If you object to a new sub-processor, contact us at privacy@sortedmate.com.
SortedMate uses a variety of trusted service providers to deliver our platform. This page lists all sub-processors who may access your personal data. Data transfers to countries outside the UK are protected by appropriate mechanisms including the UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses (SCCs), and the EU-US Data Privacy Framework with UK Extension.
Core Service Providers
These providers are always active and essential for SortedMate to operate:
| Provider | Location | Purpose | Transfer Mechanism | Certifications |
|---|---|---|---|---|
| Supabase Inc. | EU (AWS eu-west-1, Ireland) | Database, storage, edge functions | No transfer needed (EU-hosted) | SOC 2 Type II |
| Clerk Inc. | US | Authentication & identity management | UK IDTA/EU SCCs | SOC 2 Type II |
| Stripe Inc. | US/EU | Subscription billing, payment processing & connected account payment facilitation (Stripe Connect) | EU-US DPF (UK Extension) | PCI DSS Level 1 |
| Twilio Inc. | US/EU | SMS & WhatsApp messaging | EU-US DPF (UK Extension) | SOC 2 Type II |
| Resend Inc. | US | Transactional email delivery | UK IDTA/EU SCCs | SOC 2 Type II |
| PostHog Inc. | EU (eu.i.posthog.com) | Product analytics (with consent) | No transfer needed (EU-hosted) | SOC 2 Type II |
| Vercel Inc. | Global / EU | Website hosting & CDN | UK SCCs | SOC 2 Type II |
| OpenAI | US | AI text generation features | UK IDTA/SCCs | SOC 2 Type II |
User-Enabled Integrations
These providers only receive your data when you actively connect the integration. You can disconnect at any time:
| Provider | Location | Purpose | Transfer Mechanism | Certifications |
|---|---|---|---|---|
| Xero Ltd | AU/UK | Accounting sync | UK SCCs | SOC 2 Type II |
| Intuit/QuickBooks | US | Accounting sync | EU-US DPF (UK Extension) | SOC 2 Type II |
| Google LLC | US | Calendar sync, Maps, Places, reCAPTCHA | EU-US DPF (UK Extension) | SOC 2 Type II |
| Microsoft Corporation | US/EU | Outlook Calendar sync | EU-US DPF (UK Extension) | SOC 2 Type II |
Minor Vendors
These vendors have limited data exposure and process only non-sensitive information:
hCaptcha (Intuition Machines)
PURPOSE
GDPR-friendly CAPTCHA
DATA EXPOSURE
Browser fingerprint only
Logo.dev
PURPOSE
Company logo lookup
DATA EXPOSURE
Public domain data only
img.ly
PURPOSE
Image background removal
DATA EXPOSURE
Processed client-side only
Data Transfer Mechanisms
UK International Data Transfer Agreement (IDTA)
Applies to transfers from the UK to third countries. Our providers have committed to maintaining an adequate level of data protection equivalent to UK GDPR standards.
UK Addendum to EU Standard Contractual Clauses (SCCs)
Applies to transfers from the UK to countries not subject to adequacy decisions. Incorporates mandatory clauses that ensure appropriate safeguards.
EU-US Data Privacy Framework (DPF) with UK Extension
Applies to transfers to US-based providers who are certified under the framework. Ensures adequate data protection for personal data transferred from the EU and UK to the United States.
Your Rights Regarding Sub-Processors
Under UK GDPR, you have the right to:
Contact Us
If you have questions about our sub-processors or wish to object to a new processor, contact us:
SortedMate Ltd
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom
Company Registration No: 16880125
ICO Registration No: ZC090709