FIXI Group Limited(“we”) engages the third parties below to process personal data on our behalf. Each is subject to a written contract requiring it to process personal data only on our documented instructions and to meet UK GDPR data protection standards.
We notify customers of any change to this list at least 30 days before the new sub-processor begins processing. Customers may object to a new sub-processor in writing within those 30 days; we will work in good faith to resolve the objection or, failing that, we will treat the objection as written notice to terminate the affected service.
Sub-processor list
| Provider | Service | Jurisdiction | Transfer mechanism | Privacy policy |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage. Region: London (eu-west-2). Personal data stays in the UK. | United States (parent), United Kingdom (data location) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Vercel Inc. | Application hosting, serverless function runtime, CDN edge. Region: London (lhr1). | United States (parent), United Kingdom (compute region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Cloudflare, Inc. | DNS, DDoS protection, WAF, CDN, bot detection. | United States (parent); London PoP for UK traffic | UK International Data Transfer Addendum to the EU SCCs | Link |
| Stripe Payments Europe, Ltd. | Payment processing, billing subscriptions, tax calculation, invoicing. | Republic of Ireland | Adequacy (EU-UK) | Link |
| Resend | Transactional email delivery (sign-in links, billing notifications, security alerts). Region: EU. | United States (parent), Ireland (region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Upstash, Inc. | Redis-compatible key-value store for rate limiting and caching. Region: Ireland (eu-west-1). | United States (parent), Ireland (region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Functional Software, Inc. (Sentry) | Application error monitoring. Region: Frankfurt (EU). | United States (parent), Germany (region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| Axiom | Structured log ingestion and query (PII scrubbed before send). | United States (parent), United States (region) | UK International Data Transfer Addendum to the EU SCCs | Link |
| PostHog, Inc. | Product analytics (self-hosted by us in the EU). Optional, consent-gated. | United Kingdom (self-hosted) | Not applicable — UK hosting | Link |
| Anthropic, PBC | Large-language-model API (Claude). Used for AI-drafted text on customer instruction; never trained on customer data. | United States | UK International Data Transfer Addendum to the EU SCCs | Link |
| Mistral AI | Text embedding API (mistral-embed) for retrieval-augmented generation. 1024-dim vectors; no training on customer data per contract. | France (European Union) | Adequacy (EU-UK) | Link |
| Voyage AI | Text embedding API (voyage-3), transitional. Being retired as Mistral takes over the embedding workload; this entry is scheduled for removal after the cutover stabilises. | United States | UK International Data Transfer Addendum to the EU SCCs | Link |
| OpenRouter, LLC | LLM gateway used as a fallback path for non-critical AI work. Never trained on customer data. | United States | UK International Data Transfer Addendum to the EU SCCs | Link |
Notification of changes
To receive email notification of any change to this list, email privacy@hellofixi.comwith the subject line “Sub-processor change notifications”. You can unsubscribe at any time.