What this list is for
When I work for you as a processor under the GDPR, I engage the parties below as sub-processors. This list belongs to article 5.2 of the terms and conditions. I have a business contract with a data processing agreement with each party. For services, I use AI tools only with terms and settings that rule out the provider using your inputs and outputs to train models (article 2.8).
Data about visitors to this site is covered by the privacy policy.
Sub-processors
- Anthropic. Language models (Claude, Claude Code and the API) for analysis, writing and software development. Location: United States; model processing may also take place in other countries. Transfer: standard contractual clauses (SCCs).
- OpenAI. Language models (ChatGPT, Codex and the API) for analysis, writing and software development. Location: United States. Transfer: contract with OpenAI Ireland Ltd, onward transfers based on SCCs.
- Granola. Notes and transcripts of meetings, if you agree to it. Location: United States (AWS). Transfer: standard contractual clauses (SCCs).
- Supabase. Databases and storage for applications and knowledge bases I build for clients. Location: EU (Frankfurt). Transfer: SCCs for onward processors outside the EU.
- Vercel. Hosting of web applications. Location: United States, or an EU region per project. Transfer: EU-US Data Privacy Framework and SCCs.
- Railway. Hosting of backend services and automations. Location: United States, or EU West (Amsterdam) per project. Transfer: EU-US Data Privacy Framework or SCCs.
- Cloudflare. Hosting, network and security for websites and applications. Location: Global network. Transfer: EU-US Data Privacy Framework and SCCs.
- Google Workspace. Email, calendar and documents. Location: EU. Transfer: standard contractual clauses (SCCs).
Changes
If I add or replace a sub-processor, I notify clients for whom I act as a processor by email at least 30 days in advance. You can object within that period. Article 5.2 of the terms and conditions sets this out.