Subprocessor list
Version 0.15 (draft) · Pending legal review
Correction notice, 27 October 2026: what we got wrong about file paths in error reports, and what changed.
SureMatters Ltd, company number 03724474, registered in England and Wales.
How this list works
This list has two parts, and the difference between them matters to your contract.
Part A — sub-processors. A sub-processor is a third party that processes personal data on your behalf, where we are acting as your processor. Your data processing agreement attaches to Part A: 30 days’ notice before we add or replace one, a right to object, and a right to terminate the affected part of the licence if an objection cannot be resolved.
Part B — our own suppliers. These are the companies we use to run our business. Some process personal data for which we are the controller — our email, our accounting, our website. Some process no personal data at all. None of them processes anything on your behalf, so none is a sub-processor, and changing one does not affect your data or trigger any right under your agreement.
We publish Part B anyway, because a buyer assessing us should see the whole supplier picture rather than the minimum we are obliged to disclose. Disclosing more than we must should not quietly commit us to more than we should.
Customer documents do not transit our infrastructure under any tier or any add-on, so no sub-processor on this list receives them. What sub-processors handle for us is operational data — error reports, billing records, website and email correspondence. The categories are set out in the Privacy Notice.
A change to Part A — a sub-processor added, removed, or given a materially different scope — is notified by a notice on our website, a dated entry in the change history below, and a direct email to customers at least 30 days before it takes effect.
A change to Part B appears in the change history below. It carries no notice period and no objection right, because it does not touch data we hold on your behalf.
Part A — Sub-processors (Article 28)
Suppliers that process personal data on your behalf. Your agreement’s change-control rights attach to this part.
The table below last changed on 26 October 2026.
| # | Sub-processor | Service | Data processed | Location | Transfer basis | Status |
|---|---|---|---|---|---|---|
| A1 | Bugsink B.V. | Error and crash reporting for the desktop products | The type of error and its code module; the stack trace as function names, code-file names and line numbers, with no directory paths; the release, operating-system and runtime versions; a pseudonymous device identifier; two content-free error codes. No message text of any kind is sent — every exception value is sent empty — and paths are reduced to file names on your machine before anything is sent. | EU. Bugsink’s own sub-processors are Hetzner Online GmbH (Germany) and Scaleway S.A.S. (France); Stripe processes Bugsink’s payments only and is contractually excluded from application data | UK–EU adequacy. No SCCs or IDTA required | In use |
Part A has one entry, and that is the accurate answer rather than a small one. The only thing we process on your behalf is an error report, so the only sub-processor is the service that stores it.
Whether the pseudonymous device identifier is personal data in our hands is under review. It is a random value generated on your own device, never registered with us, and we hold nothing that links it to an organisation or to a person. Bugsink is listed here on the cautious view, and we will say so plainly if that view changes.
Part B — Our own suppliers
We are the controller for the personal data these companies process, or they process none at all. None of them acts on your behalf. Listed for transparency; not subject to your agreement’s sub-processor change rights.
| # | Supplier | Service | Data processed | Our role | Location | Transfer basis | Status |
|---|---|---|---|---|---|---|---|
| B1 | Cloudflare, Inc. | DNS, CDN, WAF, site hosting, form handling, bot protection (Turnstile), and access gating for preview URLs | Visitor IP addresses (truncated at the edge); request metadata; contact, pilot-enquiry and newsletter form contents; Turnstile bot-detection signals (IP, TLS fingerprint, user agent, origin — not form content), which Cloudflare also uses to improve its own service and is a controller for | Controller | UK / EEA points of presence; global edge for static assets | SCCs and the UK International Data Transfer Addendum, under Cloudflare’s published DPA | In use |
| B2 | Plausible Insights OÜ | Cookieless site analytics for surematters.com | Aggregate visitor counts, page views, referrer, browser family, country signal. No full IP address and no per-session identifier | Controller | EU (Estonia / Frankfurt) | UK–EU adequacy | In use |
| B3 | Anthropic PBC | AI assistance for our own engineering, drafting and content production | Prompts and outputs from our internal sessions; our own strategy documents and engineering artefacts. No customer documents are sent to Anthropic. | Controller, of our own material | US | SCCs under Anthropic’s commercial terms | In use |
| B4 | Keila GmbH | Newsletter delivery and sign-up | Email address, optional name, opt-in timestamp, send and open events | Controller | EU (Germany and France), with sending via Amazon SES on EU infrastructure | UK–EU adequacy | In use |
| B5 | Google Cloud EMEA Ltd | Key management (Cloud KMS) for the signing keys behind licence files and detector bundles | Cryptographic signing operations on our own artefacts. No personal data. | No personal data processed | europe-west2 (London) | Not applicable | In use, for key management only |
| B6 | Google Ireland Limited / Google LLC (Google Workspace) | Email for the SureMatters addresses; the script that receives website contact and pilot form submissions; internal document storage | Sender and recipient addresses; message contents for mail to and from our addresses; contact and pilot form submissions (name, email, organisation, message); routing metadata. No customer documents under any tier. | Controller | EU primary, with some sub-processing in the US | UK–EU adequacy for EU processing; SCCs and IDTA for US sub-processing under Google’s Workspace DPA | In use |
| B7 | Microsoft Corporation | Code-signing for our Windows release builds | Binary hashes, signing-request metadata, and our own validated company identity. No personal data of customers or operators. | No personal data processed | North Europe (Dublin) | Not applicable | In use |
| B8 | Stripe Payments UK Ltd | Card payment processing | Account-holder name, email, organisation, billing address, VAT number, payment-method token, transaction metadata | Controller | UK, with some sub-processing by Stripe, Inc. (US) | UK–US Data Bridge and SCCs, under Stripe’s published DPA | Contracted; not yet in use. Begins when self-service purchasing opens |
| B9 | Xero (UK) Limited | Our accounting and invoicing system | Organisation name, company number, billing address, VAT number, accounts-payable contact name and email, invoice line items and payment records. No customer documents. | Controller | UK and EEA | UK–EU adequacy; Xero’s published UK DPA | In use |
| B10 | Apple Inc. | Code-signing (Developer ID) and notarisation for our macOS release builds | The application bundle submitted for notarisation, binary hashes, and our own developer identity. No personal data of customers or operators. | No personal data processed | US (Apple’s notary service) | Not applicable | In use |
Row B8 is listed before it is active because a reviewer assessing us should see what is coming, not discover it later. It is marked so you can tell the difference.
What we do not yet operate
We do not currently run a telemetry service. Where the products record operational information, it stays on your own machine and is visible to you there. Nothing is transmitted to us, so nothing is stored by us and no sub-processor receives it. If that changes, it changes under the notice terms above.
We do not currently run a licence-verification service or an automatic update service. Licences are issued manually and updates are downloaded from our website.
How we choose a sub-processor
Four requirements, applied before anything is signed.
- Personal data stays in the UK or the EU, and the commitment sits in the contract rather than in a configuration setting we could change.
- A data processing agreement we can read in full before we commit, with the sub-processors named.
- No path to customer documents. This is a property of how the products are built, not a promise we ask a supplier to keep.
- A way out — data export, and a portable or self-hostable alternative where one exists.
Where a supplier cannot meet these, we use someone else. We do not publish our assessments of suppliers we did not choose; a private view of another company’s contract is not ours to broadcast.
Recipients who are not sub-processors
Your own cloud provider, if you ever deploy a SurePrepare helper service into your own tenancy. (That helper is designed and not yet built.) When it exists it will run in your infrastructure under your own agreement with your provider, and we will have no sub-processor relationship with them in respect of it.
Our advisors — solicitors, accountants, auditors — under professional confidentiality obligations.
Regulators and courts, where the law requires it.
A successor organisation, in a restructuring, sale or insolvency, subject to the protections data protection law provides.
These are recorded in the Privacy Notice. They are not on the list above because they do not process personal data on our instructions in the Article 28 sense.
Change history
| Date | Version | Change |
|---|---|---|
| 2026-05-09 | v0.1 | Initial draft. |
| 2026-05-22 | v0.2 | Google Workspace added. Newsletter vendor selected. Cloudflare entry widened to cover site hosting and access gating. |
| 2026-06-01 | v0.3 | Newsletter vendor changed to Keila, an EU-hosted provider. Removes the US transfer mechanism the previous listing carried. |
| 2026-06-10 | v0.4 | Company renamed from Footprint Limited to SureMatters Ltd, effective 8 June 2026; company number 03724474 unchanged. Email primary domain moved to surematters.com. |
| 2026-06-14 | v0.5 | Error-tracking listing marked as not yet active, the integration having been deferred to a later release. |
| 2026-06-17 | v0.6 | Launch date for SureRedact Free 1.0 updated. No sub-processor changed. |
| 2026-06-19 | v0.7 | Error-tracking vendor changed to Bugsink B.V., whose data processing agreement commits to EU-only processing of hosted personal data with named EU sub-processors. |
| 2026-06-23 | v0.8 | Microsoft added for Windows code-signing. No personal data reaches this service. |
| 2026-06-24 | v0.9 | Due diligence on the error-tracking provider completed. |
| 2026-06-24 | v0.10 | Error-tracking integration verified, and the stripping of personal data before transmission confirmed working. The Privacy Notice, the Article 30 record and the Security Architecture were updated to match. |
| 2026-06-24 | v0.11 | The provider’s data processing agreement executed. Retention of raw event data is 60 days. |
| 2026-08-12 – 13 | v0.14 | Legal-review revision. (Consolidates the drafts numbered v0.12 and v0.13.) Corrected: earlier versions described a telemetry service, a licence-verification service and an update-distribution service as operating — they are not, and no telemetry has ever been transmitted to us. The Google Cloud entry is corrected to what it actually covers, key management for signing. Xero is corrected to in use; it is our accounting system and predates the products. Restructured: vendor due-diligence records, supplier commercial terms and our own assessments of suppliers we did not select were removed, as none of it is sub-processor information. Entries not yet processing any data are now marked as such. Registered office added. This change history was also corrected — three same-day entries had been merged into one row, one row had been dropped, and a version number had been duplicated. |
| 2026-08-14 | v0.15 | Restructured into two parts. Every supplier was previously listed under one heading defined as processing personal data on our behalf. Only one of them does. The rest either process no personal data at all, or process it with us as the controller — our email, accounting, analytics, newsletter and payments. Because the data processing agreement operated by reference to this list, a change of accounting or code-signing supplier could have been read as giving a customer a right to terminate, over a change touching no customer data. Part A now carries the Article 28 change-control rights; Part B is disclosed voluntarily and carries none. No supplier was added or removed, and none changed what it does. Amended 26 October 2026, before publication: A1’s data description restated to what SureRedact 1.2.0 sends — no message text at all, paths reduced to file names — in place of “stack traces, error messages”. A correction that narrows. And one that is Material: the v0.10 row above records the stripping of personal data before transmission as “confirmed working”. It was incomplete — a folder name containing an apostrophe could leave the rest of a path in a report, and the in-app client did not strip Windows paths at all — and from 24 June to 25 October 2026 this list said paths were stripped. The correction notice published with this version, on the AI Policy page, covers it. Amended again, 27 October 2026, before publication: Apple added to Part B as B10 — Developer ID signing and notarisation of the macOS builds, as Microsoft is listed for Windows; no personal data; in use since the first macOS release on 17 June 2026. |
Contact
Questions about this list: privacy@surematters.com. We reply within 5 working days.
SureMatters Ltd, Ground Floor, 108–112 Main Road, Sundridge, Sevenoaks, TN14 6ES.
Drafted with AI assistance and reviewed by a named person, per our AI Policy.