SUB-PROCESSORS
Who else processes your data.
A public list of every third-party service AI Twin uses to operate. What they do, where they process data, and whether we have a data processing agreement in place with each one.
Last updated 17 May 2026
WHAT THIS IS
Transparency, not boilerplate.
Under UK GDPR Article 28, any service that processes personal data on our behalf is our “data processor”. This page lists every one of them. We update it when anything changes.
Each entry shows what the processor does, where in the world it processes data, and whether we have a written Data Processing Agreement (DPA) in place with them. Where a processor handles personal data, a DPA is legally required. Where it does not, a DPA is documented anyway as good practice.
THE LIST
Every sub-processor we use.
Anthropic
- Purpose
- LLM provider for product features
- Region
- European Union (Anthropic EU region)
- DPA Status
- DPA in place
Vertex AI (Google Cloud)
- Purpose
- Additional LLM and speech-to-text services
- Region
- European Union
- DPA Status
- DPA in place
Supabase
- Purpose
- Database hosting for waitlist and contact records
- Region
- European Union
- DPA Status
- DPA in place
Stripe
- Purpose
- Payment processing (when product launches)
- Region
- European Union and United Kingdom
- DPA Status
- DPA in place
Postmark
- Purpose
- Transactional email (when product launches)
- Region
- United States
- DPA Status
- DPA in place, EU-US Data Privacy Framework
Brevo (Sendinblue SAS)
- Purpose
- Marketing email and waitlist communications
- Region
- European Union (Paris, France)
- DPA Status
- DPA in place
Sentry
- Purpose
- Error and performance monitoring
- Region
- European Union
- DPA Status
- DPA in place
Cloudflare
- Purpose
- DNS, CDN, DDoS protection
- Region
- Global edge network with EU residency option
- DPA Status
- DPA in place
Plausible Analytics
- Purpose
- Privacy-friendly aggregate analytics
- Region
- European Union (Estonia)
- DPA Status
- DPA in place
Lovable Cloud
- Purpose
- Website hosting and deployment
- Region
- European Union
- DPA Status
- DPA in place
REQUESTS
If you want the underlying paperwork.
DPAs are available on request to professional buyers, prospective customers conducting their own due diligence, and data subjects exercising their information rights under UK GDPR.
Email hello@ai-twin.co.uk with “Sub-processor DPA request” in the subject line. We aim to respond within five working days for due diligence requests, and within one month for formal data subject requests as required by UK GDPR.
CHANGES
When we update sub-processors.
We update this page when we add, remove, or change a sub-processor. For waitlist members, we email you about material changes (a new processor, or a change in processing region for an existing processor) before the change takes effect. For visitors to the site, the updated list applies from the date it is published here.