Last reviewed 2026-10-27
Subprocessors
Under GDPR Article 28(2), this page lists every third party that processes personal data on our behalf in connection with the ECGT Ready platform. Where practicable, we aim to give reasonable prior notice before adding or replacing a subprocessor by updating this page, unless a faster change is required by law, a binding order, a security incident, or to keep the service running.
Want to be notified by email of changes here? Add a contact at contact@ecgtready.eu.
Corrected on 5 October 2026. Render and Cloudflare are in the list below since that date. Both have been in use since May 2026 and were missing from it, Cloudflare being shown as not active. With the same update our server functions moved from the United States to Frankfurt.
Active subprocessors
| Vendor | Purpose | Data categories | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage | Account data, audits with their findings, the audit record (page texts, pictures of the pages opened in a browser, cookie names and hosts), demo and contact requests, uploaded supporting documents; since 27 October 2026 the conversations and checks of Reggie with their citations, the files, pictures, labels and policy documents given to it and the context of the store | EU (eu-central-1, Frankfurt) | Stored in the EU; SCCs for any access by Supabase from outside the EEA |
| Vercel Inc. | Hosting, edge network, server functions | All web traffic, logs, request metadata; the server functions run the audits and every call to the database | Server functions in the EU (Frankfurt); the edge network answers from the location nearest to the visitor | SCCs (2021/914); Vercel is DPF certified |
| Anthropic, PBC | Model inference for the audits and checks of the platform | The text of the pages being audited and their addresses; where present also the workspace product profile, the lines of your policy library and the labels and descriptions of uploaded supporting documents (not the files themselves); since 27 October 2026 the questions asked to Reggie, the pages, texts, files and pictures given to it to check, the context of the store, the labels held with their scope and end date and the text of the policy documents | US | SCCs; Anthropic does not train on API data |
| Render Services, Inc. | The browser step of a full audit and of pages that cannot be read without a browser (opens public pages of the audited site, takes the pictures, lists cookie names and other hosts) | Addresses and content of public pages of the audited site, and the pictures taken of them before they are stored with Supabase | EU (Frankfurt) | Hosted in the EU; DPF or SCCs under the Render data processing addendum for any access from outside the EEA |
| Cloudflare, Inc. | Bot protection on the sign in and sign up pages (Turnstile) | IP address, TLS fingerprint and user agent of the person who signs in or signs up | Global network | Cloudflare is DPF certified; SCCs |
| Stripe Payments Europe Ltd. | Payment processing | Customer name, email, tokenised card data, billing address | Ireland (EU) primary, US fallback | SCCs; PCI-DSS Level 1 |
| Resend, Inc. | Transactional email | Recipient email and message content | US | SCCs; DPF certified |
How to object
If you object to a subprocessor on reasonable data-protection grounds, write to contact@ecgtready.eu within 14 days of the change notice. We will work with you to find an alternative. If we cannot, you may terminate the affected service for convenience.