Sub-processors
Every third party that processes customer data, named.
OpX maintains an up-to-date register of all sub-processors authorised to process customer Personal Data. Customers receive 30 days' prior notice of any addition or replacement.
Current register
| Sub-processor | Purpose / data categories | Processing location | Transfer mechanism |
|---|---|---|---|
| Supabase (via AWS) | Managed PostgreSQL, object storage, edge functions | UK (AWS eu-west-2) | Intra-UK |
| Amazon Web Services | Underlying cloud infrastructure | UK (eu-west-2) | Intra-UK |
| Cloudflare | CDN, WAF, DDoS protection, DNS | Global edge (anycast) | UK IDTA |
| WorkOS | Enterprise SSO (SAML/OIDC), SCIM directory sync | US / EU | UK IDTA + SCC |
| Stripe | Billing and subscription management | US / EU | UK IDTA + SCC |
| Resend | Transactional email delivery | EU | UK IDTA |
| OpenAI | LLM inference and embeddings (anonymised prompts, no-training) | US | UK IDTA + SCC |
| ElevenLabs | Voice synthesis for learning content (where enabled) | US | UK IDTA + SCC |
| Jina AI | Web content extraction for research workflows | EU | UK IDTA |
- Sub-processor
- Supabase (via AWS)
- Purpose / data categories
- Managed PostgreSQL, object storage, edge functions
- Processing location
- UK (AWS eu-west-2)
- Transfer mechanism
- Intra-UK
- Sub-processor
- Amazon Web Services
- Purpose / data categories
- Underlying cloud infrastructure
- Processing location
- UK (eu-west-2)
- Transfer mechanism
- Intra-UK
- Sub-processor
- Cloudflare
- Purpose / data categories
- CDN, WAF, DDoS protection, DNS
- Processing location
- Global edge (anycast)
- Transfer mechanism
- UK IDTA
- Sub-processor
- WorkOS
- Purpose / data categories
- Enterprise SSO (SAML/OIDC), SCIM directory sync
- Processing location
- US / EU
- Transfer mechanism
- UK IDTA + SCC
- Sub-processor
- Stripe
- Purpose / data categories
- Billing and subscription management
- Processing location
- US / EU
- Transfer mechanism
- UK IDTA + SCC
- Sub-processor
- Resend
- Purpose / data categories
- Transactional email delivery
- Processing location
- EU
- Transfer mechanism
- UK IDTA
- Sub-processor
- OpenAI
- Purpose / data categories
- LLM inference and embeddings (anonymised prompts, no-training)
- Processing location
- US
- Transfer mechanism
- UK IDTA + SCC
- Sub-processor
- ElevenLabs
- Purpose / data categories
- Voice synthesis for learning content (where enabled)
- Processing location
- US
- Transfer mechanism
- UK IDTA + SCC
- Sub-processor
- Jina AI
- Purpose / data categories
- Web content extraction for research workflows
- Processing location
- EU
- Transfer mechanism
- UK IDTA
Change notifications
Subscribe to sub-processor updates
We notify customers at least 30 days before adding or replacing a sub-processor. To receive these notifications by email, subscribe opposite. Customers can object on legitimate data protection grounds within the notice period; we'll work with you to find an acceptable alternative or, if none is reasonable, you can terminate the affected services.