Important Notice: We will notify users of any changes to this list at least 30 days before adding a new sub-processor. If you object to a new sub-processor, contact us at privacy@sortedmate.com.
SortedMate uses a variety of trusted service providers to deliver our platform. This page lists all sub-processors who may access your personal data. Data transfers to countries outside the UK are protected by appropriate mechanisms including the UK International Data Transfer Agreement (IDTA), UK Addendum to EU Standard Contractual Clauses (SCCs), and the EU-US Data Privacy Framework with UK Extension.
Core Service Providers
These providers are always active and essential for SortedMate to operate:
| Provider | Location | Purpose | Transfer Mechanism | Certifications |
|---|---|---|---|---|
| Supabase Inc. | UK (AWS eu-west-2, London) | Database, storage, edge functions | No transfer needed (UK-hosted) | SOC 2 Type II |
| Clerk Inc. | US | Authentication & identity management | UK IDTA/EU SCCs | SOC 2 Type II |
| Stripe Inc. | US/EU | Subscription billing, payment processing & connected account payment facilitation (Stripe Connect) | EU-US DPF (UK Extension) | PCI DSS Level 1 |
| Twilio Inc. | US/EU | SMS & WhatsApp messaging | EU-US DPF (UK Extension) | SOC 2 Type II |
| Resend Inc. | US | Transactional email delivery | UK IDTA/EU SCCs | SOC 2 Type II |
| PostHog Inc. | EU (eu.i.posthog.com) | Product analytics (with consent) | No transfer needed (EU-hosted) | SOC 2 Type II |
| Vercel Inc. | Global / EU | Website hosting & CDN | UK SCCs | SOC 2 Type II |
| OpenAI | US | AI text generation features | UK IDTA/SCCs | SOC 2 Type II |
User-Enabled Integrations
These providers only receive your data when you actively connect the integration. You can disconnect at any time:
| Provider | Location | Purpose | Transfer Mechanism | Certifications |
|---|---|---|---|---|
| Xero Ltd | AU/UK | Accounting sync | UK SCCs | SOC 2 Type II |
| Intuit/QuickBooks | US | Accounting sync | EU-US DPF (UK Extension) | SOC 2 Type II |
| Google LLC | US | Calendar sync, Maps, Places, reCAPTCHA | EU-US DPF (UK Extension) | SOC 2 Type II |
| Microsoft Corporation | US/EU | Outlook Calendar sync | EU-US DPF (UK Extension) | SOC 2 Type II |
Minor Vendors
These vendors have limited data exposure and process only non-sensitive information:
hCaptcha (Intuition Machines)
- Purpose: GDPR-friendly CAPTCHA
- Data Exposure: Browser fingerprint only
Logo.dev
- Purpose: Company logo lookup
- Data Exposure: Public domain data only
img.ly
- Purpose: Image background removal
- Data Exposure: Processed client-side only
Data Transfer Mechanisms
UK International Data Transfer Agreement (IDTA)
Applies to transfers from the UK to third countries. Our providers have committed to maintaining an adequate level of data protection equivalent to UK GDPR standards.
UK Addendum to EU Standard Contractual Clauses (SCCs)
Applies to transfers from the UK to countries not subject to adequacy decisions. Incorporates mandatory clauses that ensure appropriate safeguards.
EU-US Data Privacy Framework (DPF) with UK Extension
Applies to transfers to US-based providers who are certified under the framework. Ensures adequate data protection for personal data transferred from the EU and UK to the United States.
Your Rights Regarding Sub-Processors
Under UK GDPR, you have the right to:
- Be informed about all sub-processors handling your data
- Object to the use of a new sub-processor before processing begins
- Request details about how sub-processors handle your data
- Request deletion of your data from sub-processors
- Lodge complaints with the ICO regarding sub-processor practices
Contact Us
If you have questions about our sub-processors or wish to object to a new processor, contact us:
- Email: privacy@sortedmate.com
- SortedMate Ltd
- 3rd Floor, 86-90 Paul Street
- London, EC2A 4NE
- United Kingdom
- Company Registration No: 16880125
- ICO Registration No: ZC090709