Sub-Processor Register
Last updated: 10 September 2026
Stabilise Ltd engages the third-party Sub-Processors listed below to process Client Personal Data in delivering our Services. This page is the Sub-Processor Register referred to in Schedule 1 of our Master Services Agreement and is the authoritative list. For each Sub-Processor it sets out the service provided, the categories of Client Personal Data involved, the location of processing, and the safeguard for any transfer outside the United Kingdom.
Clients receive at least 14 days' notice before any addition or change and may object under their Agreement. Questions and objections: dustin@stabilise.io
A. Sub-Processors used to deliver Services to you
| Sub-Processor | Service provided | Client Personal Data involved | Location of processing | Safeguard for any transfer outside the UK |
|---|---|---|---|---|
| Apple Inc. | Apple Business Manager, iCloud, Apple Push Notification Service (device enrolment and management) | Device and account identifiers, user names and email addresses | United States and other countries | Apple's data processing terms, incorporating Standard Contractual Clauses / UK Addendum |
| Jamf Software LLC (Jamf Pro and Jamf Protect), where named in the Scope of Works | Apple device management and endpoint security, delivered through our managed service provider instance | Device identifiers, configuration and inventory, security telemetry, user names and email addresses | United Kingdom | Not a restricted transfer (United Kingdom); Jamf's data processing agreement and its transfer terms apply as a backstop for its US corporate group |
| Any other mobile device management vendor named in the Scope of Works | Device management platform | Device identifiers, configuration, user names and email addresses | As stated in the vendor's terms and the Scope of Works | The vendor's data processing agreement and its transfer terms |
| Google LLC and/or Microsoft Corporation, where we administer your Google Workspace or Microsoft 365 tenant | Productivity and identity platform administration | The personal data held in your own tenant | Your tenant's configured region | The provider's data processing agreement and its transfer terms |
| The cloud storage or backup provider named in the Scope of Works (for example Dropbox) | File storage and/or backup | Files and their contents | As stated in the vendor's terms and the Scope of Works | The vendor's data processing agreement and its transfer terms |
| AgileBits Inc. (1Password) | Secure storage of credentials we hold on your behalf to deliver the Services | Administrative credentials and secrets relating to your systems; no end-user personal data | European Union | Not a restricted transfer (European Union, covered by the UK adequacy regulations); 1Password's data processing agreement and its transfer terms apply as a backstop for its Canadian corporate group; secrets are encrypted such that the provider cannot read them |
| Tailscale Inc. | Private network access used by our engineers to reach your systems, and, where specified in the Scope of Works, between your own devices and systems | Connection metadata only: device and user identifiers, device names and connection events. Traffic between devices is end-to-end encrypted, so the provider cannot read the contents of anything sent over the network | Tailscale's global control plane, operated from Canada and the United States. Only connection metadata reaches it; traffic between devices never does | Tailscale's data processing addendum, incorporating Standard Contractual Clauses / UK Addendum; Canada holds a UK adequacy decision for commercial organisations; the provider handles encrypted traffic and connection metadata only, never traffic content |
| Ingram Micro Limited | Software licence procurement and fulfilment where we resell licences named in the Scope of Works (for example Okta) | Your organisation's name and the name and email address of your licensing contact | United Kingdom | Not a restricted transfer (United Kingdom) |
| BitTitan, Inc. (MigrationWiz), where a migration is named in the Scope of Works | Mailbox, file and account migration between platforms | The contents of the mailboxes and files being migrated, and account identifiers, processed in transit only for the duration of the migration and not stored afterwards | Europe region selected for the project (Microsoft Azure) | Not a restricted transfer (European Union, covered by the UK adequacy regulations); BitTitan's data processing agreement, incorporating Standard Contractual Clauses / UK Addendum, applies as a backstop for its US corporate group |
| CyberSmart Ltd, where named in the Scope of Works | Cyber Essentials compliance and device monitoring | Staff names, email addresses, device identifiers and configuration | United Kingdom and Ireland | Not a restricted transfer (United Kingdom; Ireland is covered by the UK adequacy regulations) |
| Mosyle Corporation, where named in the Scope of Works | Apple device management (legacy instances being migrated) | Device identifiers, configuration and inventory, user names and email addresses | United States | Mosyle's terms, which include its processor terms and Standard Contractual Clauses / UK Addendum |
B. Sub-Processors within our internal operating system
These process Client Personal Data on our behalf because our operating system and our own business systems hold communications and records relating to you.
| Sub-Processor | Service provided | Client Personal Data involved | Location of processing | Safeguard for any transfer outside the UK |
|---|---|---|---|---|
| Supabase (hosted on Amazon Web Services) | Database and system of record for our operating system | The categories in Annex 1, as held in our system | London, United Kingdom (eu-west-2) | Not a restricted transfer (United Kingdom) |
| Amazon Web Services (Amazon Bedrock) | Artificial intelligence model inference for the automated processing described in clause 3.5, and for our staff's supervised use of our operating system | The limited retrieved context for a task and the question asked, not a bulk copy; the content is not used for training and is not shared with the model vendor | AWS European regions: requests originate in London, United Kingdom (eu-west-2) and are served by the European Union inference profile | Not a restricted transfer for the United Kingdom; European Union processing is covered by the UK adequacy regulations; AWS's data processing terms apply |
| Google LLC (Google Workspace, our own tenant) | Our email, calendar, files and meeting notes, which contain communications and context relating to you | Names, contact details and the content of communications with you | United States | UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), with Google's data processing amendment, incorporating Standard Contractual Clauses / UK Addendum, as a backstop |
| Slack Technologies (Salesforce, Inc.) | Our internal messaging, and the shared support channel in your workspace where one is in place | Names, contact details and the content of support conversations | United States | UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), with Slack's data processing addendum, incorporating Standard Contractual Clauses / UK Addendum, as a backstop |
| GitHub, Inc. (Microsoft Corporation) | Version control for our business records and delivery documentation | Client documents and records held in our business repository | United States | The confidential parts of the repository are encrypted before they leave our machines, so the provider stores ciphertext only; GitHub's data protection agreement and Standard Contractual Clauses / UK Addendum apply |
| Notion Labs, Inc. | Our internal knowledge, client records and pipeline | Names, contact details, engagement records | United States | Notion's data processing addendum, incorporating Standard Contractual Clauses / UK Addendum |
| Intercom, Inc. | Support ticketing and website chat | Names, contact details and the content of support enquiries | United States | UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), with Intercom's data processing agreement, incorporating Standard Contractual Clauses / UK Addendum, as a backstop |
| Vercel Inc. | Hosting and compute for the web application | Data in transit; system and access logs | Compute runs in London, United Kingdom (region lhr1). Vercel Inc. is incorporated in the United States and operates a global edge network | Not a restricted transfer for the compute and the data it processes (United Kingdom); Vercel's data processing agreement, incorporating Standard Contractual Clauses / UK Addendum, applies to the provider's US corporate group |
| Railway Corporation | Hosting and compute for the background worker | Data in transit and processing | European Union (Amsterdam, Netherlands); Railway offers no United Kingdom region | Not a restricted transfer (European Union, covered by the UK adequacy regulations); Railway's data processing agreement applies as a backstop for its US corporate group |
| Resend, Inc. | Transactional email delivery of our operating system's internal reports to our own staff (for example the nightly activity ledger) | Names of clients and contacts as they appear in those reports, in transit; nothing is stored beyond delivery logs | United States | Resend's data processing agreement, incorporating Standard Contractual Clauses / UK Addendum |
| Okta, Inc. | Staff identity and access management | Staff email, name and group membership only; no Client content | Okta cloud | Identity data only; provider's data processing agreement and transfer terms apply |
| Twilio Inc. | Business telephony and messaging behind our United Kingdom business number | Names, telephone numbers, call records and the content of messages exchanged with you | United States (default region) | UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), with Twilio's data processing addendum, incorporating Standard Contractual Clauses / UK Addendum, as a backstop |
Notes
- We hold written data processing terms with each Sub-Processor named above, as required by clause 3.3.3 of the Agreement, either incorporated in the provider's terms of service or executed separately.
- Where a Sub-Processor's corporate group sits outside the United Kingdom even though the data is hosted in the UK or EU, the provider's own data processing agreement and its Standard Contractual Clauses or UK Addendum apply as a backstop.
- Suppliers who do not process Client Personal Data on our behalf are not Sub-Processors and are not listed. Our accounting, banking and procurement providers see our own business records, including client names and billing contacts, in their capacity as our suppliers. Vanta is not listed either: we resell it and the client contracts with Vanta directly. On that basis Xero, Revolut and cal.com are not listed: they hold our own customer billing and scheduling records, of which we are the controller.
Subscribe to changes
To receive notice of additions and changes to this Register by email, subscribe below. This is how we deliver the 14 days' notice described above. You can unsubscribe at any time. If you prefer, email dustin@stabilise.io and ask to be added.
Change log
Every change to this Register is recorded here, newest first. Clients receive at least 14 days' notice of an addition or change before it takes effect for their Services.
- 10 September 2026: Automated AI processing moved to Amazon Web Services' Bedrock service (European Union inference profile, requests from London) later the same day; Anthropic removed as a Sub-Processor. Our staff's interactive use of the operating system runs through the same service.
- 10 September 2026: Correction to the 9 September entry: the move of automated AI processing to Amazon Bedrock in London has not been made. Automated AI processing runs on Anthropic's API in the United States under its commercial terms (no training, retention of up to 30 days), so Anthropic is reinstated and Amazon Web Services (Bedrock) is removed until it is in use. Resend added: it delivers our operating system's internal reports to our own staff by email.
- 9 September 2026: Anthropic removed: all AI processing of Client Personal Data, automated and interactive, runs on Amazon Web Services' Bedrock service in London and Anthropic never receives it. Linear removed (no longer used). Ingram Micro (UK), Twilio (US), BitTitan (EU, migrations), CyberSmart (UK) and Mosyle (US) added. Railway corrected to the European Union (Amsterdam). Processing locations confirmed for Jamf (UK), 1Password (EU), Tailscale (control plane, Canada/US), our Google Workspace tenant (US, data bridge), Slack (US, data bridge), Notion (US), Intercom (US, data bridge).
- 25 August 2026: Register published as a maintained page. Added Jamf (named), 1Password, Tailscale, our own Google Workspace tenant, Slack, GitHub, Notion and Intercom.
- 24 August 2026: Amazon Web Services (Bedrock) added for automated AI processing in the United Kingdom; Anthropic's entry narrowed to our consultants' supervised interactive use.
- 24 August 2026: Register first published, reproducing Annex 2 of the Master Services Agreement version 2.1.
This change log is append-only. The full history of this page is also kept under version control.