Last updated 5 September 2026
Sub-processors
Part of the trust centre. A sub-processor is a third party that processes personal data on our behalf. This list is derived from the services our code actually calls, not from memory, and each entry says what that service receives.
Current sub-processors
| Provider | Purpose | What it receives | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All workspace data; login email addresses; uploaded purchase-order files; signup and password-reset email is sent by Supabase's own sender | AWS eu-west-2 (London) |
| Vercel | Application hosting and serverless functions | Request traffic to the application, including whatever a page or action carries in flight; no customer data is stored at rest with Vercel | Global edge; functions run in Vercel's default region |
| Resend | Email, in both directions | Outbound: invites, invoices and purchase orders with their PDF attachments, and dispatch instructions to a warehouse — which contain delivery addresses. Inbound: purchase-order emails to the workspace intake address are received and stored by Resend, attachments included, until collected | United States |
| Google (Gemini API) | The optional assistant and document-understanding features | Extracted text of a text purchase order; the whole file for a scanned or photographed one; the order records needed to answer an assistant question, which include customer names. Sent only when one of those features is used, and never when the workspace has switched them off | Google Cloud; region not fixed by the API |
Where a provider is outside the UK, we rely on the safeguards in its terms — the UK extension to the EU–US Data Privacy Framework or standard contractual clauses, as applicable.
Not sub-processors: the services you connect
Sales channels, marketplaces, warehouses and accounting systems the customer connects receive and send data on the customer's instruction, under the customer's own agreement with that provider.
Changes to this list
We will update this page before a new sub-processor receives customer data, and email the billing contact of every workspace at least 14 days beforehand. A customer who objects on reasonable data-protection grounds may terminate under the data processing agreement. Questions: privacy@throughlineop.co.uk.