Sub-Processors
Snubnose uses a small number of third-party sub-processors to help deliver the platform. This page is the definitive, current list of every sub-processor that may process personal data on behalf of our customers, what each one does, and where it is located.
All customer data is hosted in the United Kingdom. AI processing can be configured to run entirely within the UK. Where a sub-processor is a US-incorporated company, this is noted alongside the region in which it actually processes data.
What is a sub-processor?
A sub-processor is a third party that Snubnose engages to process personal data as part of providing the platform. Under UK data protection law, we authorise each sub-processor, bind it to written data protection obligations no less protective than our own, and remain responsible to our customers for its performance.
Current sub-processors
| Sub-Processor | Legal Entity & Location | Purpose | Data Processed | Contractual basis |
|---|---|---|---|---|
| Fly.io | Fly.io, Inc., San Francisco, USA (London, UK infrastructure) | Application hosting, managed PostgreSQL database, compute infrastructure | All personal data stored in the platform database, including content derived from documents during AI processing | Data Processing Addendum executed |
| Tigris | Tigris Data, Inc., USA (London, UK region) | S3-compatible object storage for evidence documents and attachments | Evidence documents, file attachments, organisation data | Data Processing Addendum executed |
| Amazon Web Services | Amazon Web Services, Inc., USA (eu-west-2, London, UK region) | Claude model inference via Amazon Bedrock, for customers electing UK data residency (UK Inference) | Evidence document content, control and scope assessment data | AWS GDPR Data Processing Addendum |
| Amazon Web Services | Amazon Web Services, Inc., USA (eu-west-2, London, UK region) | Self-hosted model inference on Snubnose-operated infrastructure (Private Inference) | Evidence document content (text) | AWS GDPR Data Processing Addendum |
| Anthropic | Anthropic, PBC, San Francisco, USA | Claude model inference: evidence validation, control applicability and scope analysis, for customers electing global inference (Global Inference) | Evidence document content, organisation metadata, scope and control data | Anthropic Commercial Terms of Service, incorporating its data processing terms and Standard Contractual Clauses for international transfers |
| Resend | Resend, Inc., San Francisco, USA | Transactional email delivery (account notifications, invitations, access links) | User and organisation email addresses, names, and account and access links | Data Processing Addendum executed |
| Google LLC | Mountain View, California, USA | OAuth 2.0 authentication; Google Places API for address autocomplete | Email address, user profile information (name, profile image), typed organisation address data | Google Cloud data processing terms |
| Microsoft Corporation | Redmond, Washington, USA | OAuth 2.0 authentication (Entra ID); Microsoft 365 evidence integration where enabled by a customer | Email address and user profile information; where the integration is enabled, the customer's tenant directory, device and security configuration data | Microsoft Online Services Data Protection Addendum |
| PostHog | PostHog Inc., San Francisco, USA | Product analytics (opt-in only); application log ingestion | Pseudonymous user and organisation identifiers, product events, device and browser metadata, approximate location (from IP); application logs | PostHog Data Processing Addendum; analytics processed only where the user has opted in |
Data residency and AI inference
All customer data is stored in the United Kingdom (Fly.io London region, and UK-resident object storage). AI processing is provided through one of three configurations:
- UK Inference: processing runs on Amazon Bedrock in the eu-west-2 (London) region. No data leaves the United Kingdom for the purposes of the AI features.
- Private Inference: processing runs on a model hosted on Snubnose-operated infrastructure in the eu-west-2 (London) region, and is not transmitted to any third-party inference provider.
- Global Inference: the relevant data is transmitted to Anthropic in the United States for real-time processing, under Anthropic's Commercial Terms of Service and Standard Contractual Clauses for the international transfer.
Notes
- UK infrastructure: Fly.io and (where UK or Private Inference is used) Amazon Web Services are US-incorporated companies whose infrastructure for the platform operates from the London, UK region. Personal data is stored and processed in the UK.
- Amazon Web Services control-plane: Snubnose also uses AWS Systems Manager to configure and manage the power state of the Private Inference infrastructure, and AWS Cost Explorer for billing telemetry. Neither processes personal data or customer document content; they are listed here for completeness only.
- Product analytics: analytics via PostHog are opt-in. Prompt and completion content from AI features is never sent to PostHog.
- Data localisation: customers may elect UK Inference or Private Inference so that no data is transmitted outside the United Kingdom for the purposes of the AI features.
Changes to this list
We keep this list current. Before we add or replace a sub-processor, we notify affected customers in advance in accordance with their applicable Data Processing Agreement, and provide an opportunity to object on reasonable data protection grounds. Where an objection cannot be resolved, the customer may terminate the affected services.
To be notified of changes, contact privacy@snubnose.io.
Contact
For questions about this list or our use of sub-processors, please contact:
Snubnose Ltd
Company number: 17048932
Registered in England and Wales
Email: privacy@snubnose.io
See also our Data Processing Agreement and Privacy Policy.