Sub-processors: HelpCCMS
Last updated: 22 September 2026.
This page lists the third parties we engage to provide HelpCCMS, what they do, where the data sits, and (where the party is established outside the EEA) the legal basis for that transfer. It is referenced from the privacy policy and from §5 of the data processing agreement.
We notify customers by email of a new or replacement sub-processor, with a 30-day objection period before the change takes effect.
Current sub-processors
| Sub-processor | What they do for us | Data stored in | Transfer basis for the US |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU region | Standard Contractual Clauses |
| Vercel | Application hosting | EU region | EU-US Data Privacy Framework (certified), supplemented by SCCs |
| Stripe | Payments, subscriptions and invoicing | US | EU-US Data Privacy Framework (certified) |
| Postmark (AC PM LLC, part of ActiveCampaign) | Sending transactional email | US | EU-US Data Privacy Framework (certified), supplemented by SCCs |
| Zoho | Our own mailboxes, so any email you send us | EU data centre | Standard Contractual Clauses (intra-group) |
Two things worth knowing
No feature currently available in HelpCCMS sends customer content to an AI model. There is therefore no AI sub-processor on this list. That is a property of the product rather than a policy promise: the paths that once did this are closed in the code, and the only import the product offers reads a JSON file and parses it. If that changes, this page is updated before the feature reaches a customer, with the 30-day objection period above.
Supabase and Vercel store our data in an EU region, but both are US companies. Incidental access from the US (for example by support staff) cannot be ruled out, which is what the transfer basis in the table covers.
How we verify this
The transfer basis per party is checked against that party's own published privacy documentation, and against the U.S. Department of Commerce Data Privacy Framework list where certification is claimed. Last verified: 22 September 2026.