Sub-Processor Register
Last updated: 24 August 2026
Stabilise Ltd engages the third-party Sub-Processors listed below to process Client Personal Data in delivering our Services. This page is the Sub-Processor Register referred to in Schedule 1 of our Master Services Agreement and is the current authoritative list between versions of that Agreement. For each Sub-Processor it sets out the service provided, the categories of Client Personal Data involved, the location of processing, and the safeguard for any transfer outside the United Kingdom.
Clients receive at least 14 days' notice before any addition or change and may object under their Agreement. Questions and objections: dustin@stabilise.io.
A. Sub-Processors used to deliver Services to you
| Sub-Processor | Service provided | Client Personal Data involved | Location of processing | Safeguard for any transfer outside the UK |
|---|---|---|---|---|
| Apple Inc. | Apple Business Manager, iCloud, Apple Push Notification Service (device enrolment and management) | Device and account identifiers, user names and email addresses | United States and other countries | Apple's data processing terms, incorporating Standard Contractual Clauses / UK Addendum |
| The mobile device management vendor named in the Scope of Works (for example Jamf) | Device management platform | Device identifiers, configuration, user names and email addresses | As stated in the vendor's terms and the Scope of Works | The vendor's data processing agreement and its transfer terms |
| Google LLC and/or Microsoft Corporation, where we administer your Google Workspace or Microsoft 365 tenant | Productivity and identity platform administration | The personal data held in your own tenant | Your tenant's configured region | The provider's data processing agreement and its transfer terms |
| The cloud storage or backup provider named in the Scope of Works (for example Dropbox) | File storage and/or backup | Files and their contents | As stated in the vendor's terms and the Scope of Works | The vendor's data processing agreement and its transfer terms |
B. Sub-Processors within our internal operating system
These process Client Personal Data on our behalf because our operating system draws on our own business records relating to you (clause 3.5).
| Sub-Processor | Service provided | Client Personal Data involved | Location of processing | Safeguard for any transfer outside the UK |
|---|---|---|---|---|
| Supabase (hosted on Amazon Web Services) | Database and system of record for our operating system | The categories in Annex 1, as held in our system | London, United Kingdom (eu-west-2) | Not a restricted transfer (United Kingdom) |
| Amazon Web Services (Amazon Bedrock) | Artificial intelligence model inference for the automated processing described in clause 3.5 | The limited retrieved context for a task and the question asked, not a bulk copy; the content is not stored or logged, not used for training, and not shared with the model vendor | London, United Kingdom (eu-west-2), with failover confined to AWS regions in Europe | Not a restricted transfer (United Kingdom); any Europe failover is covered by the UK adequacy regulations; AWS's data processing terms apply |
| Anthropic PBC | Artificial intelligence for our consultants' supervised interactive use on client matters (clause 3.5) | The limited context for the matter in hand, not a bulk copy; no training on the content | United States | International Data Transfer Agreement / UK Addendum to the Standard Contractual Clauses, plus a documented Transfer Risk Assessment |
| Vercel Inc. | Hosting and compute for the web application | Data in transit; system and access logs | London, United Kingdom (lhr1) | Not a restricted transfer for the hosted data (United Kingdom); where the provider's group is outside the UK, the provider's data processing agreement and transfer terms apply |
| Railway | Hosting and compute for the background worker | Data in transit and processing | London / European Union | Not a restricted transfer for the hosted data (UK/EU); provider's data processing agreement applies as above |
| Okta | Staff identity and access management | Staff email, name and group membership only; no Client content | Okta cloud | Identity data only; provider's data processing agreement and transfer terms apply |
| Linear | Task management | Derived task titles and descriptions and AI comments; not raw ingested content | European Union | Not a restricted transfer (EU); to be confirmed as EU residency |
Note: Where a Sub-Processor's corporate group sits outside the United Kingdom even though the data is hosted in the UK or EU, the provider's own data processing agreement and its Standard Contractual Clauses or UK Addendum apply as a backstop.
Subscribe to changes
To receive notice of additions and changes to this Register by email, subscribe below. This is how we deliver the 14 days' notice described above. You can unsubscribe at any time. If you prefer, email dustin@stabilise.io and ask to be added.
Change log
- 24 August 2026: Register first published, reproducing Annex 2 of the Master Services Agreement version 2.1.
This change log is append-only. The full history of this page is also kept under version control.