Sub-processor register

Last updated 2026-09-22. Institutions with a data processing agreement receive 30 days' notice before a new sub-processor is added.

How transfers are covered

Your account, learning-record and organisation data is stored in the United Kingdom (AWS London, via Supabase). Some of the companies that help us run the service process data elsewhere. Where personal data leaves the UK we rely on one of the tools UK GDPR allows:

EEA adequacy regulations for providers processing in the European Economic Area.
The UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement (IDTA), both issued by the ICO, written into each provider's data processing agreement.
The UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework) where a US provider is certified under it; we check the certification list before relying on it.

Transfer risk assessments for any listed provider are available to institutional customers on request. Entries marked "to be confirmed" are being checked with the provider and will be updated here.

Sub-processors that run the service

Supabase

Supabase, Inc. (United States)

Purpose: Database, authentication, file storage and server-side functions for the whole platform
Data it receives: All account, learning-record, organisation and billing-reference data
Where: AWS eu-west-2 (London, United Kingdom) for the database, authentication and storage. Function code runs on Supabase's edge network and reads and writes the London database.
Transfer tool: UK Addendum to the EU SCCs
When: Always
Provider terms: https://supabase.com/legal/dpa
Verified: Database host resolved into the published AWS eu-west-2 address range on 2026-09-22.
Note: The provider is a US company with administrative access, which is why a transfer tool is listed even though the data sits in London.

Cloudflare

Cloudflare, Inc. (United States)

Purpose: Website hosting (Pages), DNS, TLS, content delivery, request security and two small edge workers (crawler pre-rendering, AI-crawler logging)
Data it receives: IP address, request headers, page requested; no account data
Where: Global edge network including the United Kingdom
Transfer tool: UK-US data bridge (DPF) or UK Addendum
When: Always
Provider terms: https://www.cloudflare.com/cloudflare-customer-dpa/

Stripe

Stripe Payments UK Ltd / Stripe, Inc.

Purpose: Card payments, subscriptions, invoices and the billing portal
Data it receives: Name, email address, payment amount, subscription status; card details go to Stripe directly and never touch our systems
Where: Processed in the United States and other Stripe regions
Transfer tool: UK-US data bridge (DPF) or UK Addendum
When: When you pay by card
Provider terms: https://stripe.com/legal/dpa

Paystack

Paystack Payments Ltd (Nigeria), a Stripe company

Purpose: Card and bank payments for customers paying in Nigerian naira and selected African countries
Data it receives: Email address, payment amount, subscription code; card details go to Paystack directly
Where: AWS Ireland, per Paystack's published security statement
Transfer tool: EEA adequacy regulations
When: When you pay through Paystack
Provider terms: https://paystack.com/privacy/merchant
Note: Paystack's own policy allows it to use servers in other jurisdictions under contractual safeguards.

Resend

Resend, Inc. (United States)

Purpose: Transactional email: verification codes, receipts, GDPR confirmations, complaint acknowledgements, notifications
Data it receives: Email address, name, the content of the email sent to you; delivery logs
Where: United States (AWS us-east-1). Resend stores account data, logs and metadata in the US even when an EU sending region is selected.
Transfer tool: UK Addendum to the EU SCCs
When: Whenever we email you
Provider terms: https://resend.com/legal/dpa
Verified: Earlier versions of our documents said "AWS Ireland"; corrected on 2026-09-22 against Resend's published position.

Google Gemini API

Google LLC (United States)

Purpose: AI features: interview coach, STP coaches, help chat, biomedical assistant, blood-film image analysis
Data it receives: The text you type into an AI feature and images you upload to it. No name, email or account identifier is sent.
Where: Global endpoint; Google gives no regional processing guarantee for the Gemini API
Transfer tool: UK Addendum to the EU SCCs
When: Only when you use an AI feature
Provider terms: https://ai.google.dev/gemini-api/terms
Note: We use the paid tier, on which Google does not use prompts or responses to improve its models.

Groq

Groq, Inc. (United States)

Purpose: Fallback text generation for the biomedical AI assistant when Gemini is unavailable
Data it receives: The text you type into the assistant; no account identifier
Where: United States
Transfer tool: UK Addendum to the EU SCCs
When: Only when you use the biomedical AI assistant and Gemini is unavailable
Provider terms: https://groq.com/privacy-policy/

ReachSurge (our own analytics service, hosted on Vercel)

ReachSurge is built and operated by PathologyLabTraining; it runs on Vercel, Inc. (United States)

Purpose: Cookieless page statistics and detection of visits referred by AI assistants; per-page SEO metadata
Data it receives: Page URL, referrer, coarse location derived from IP; no cookie and no account identifier
Where: Served from Vercel's edge network (London point of presence observed on 2026-09-22); the analytics store region is stated by us on request
Transfer tool: UK-US data bridge (DPF) or UK Addendum
When: Always
Provider terms: https://vercel.com/legal/dpa
Note: Because ReachSurge is ours, the third party here is its host, Vercel.

eSignatures.com

Galamian Pty Ltd, trading as eSignatures.com

Purpose: Electronic signature of institutional contracts and purchase orders
Data it receives: Signer name, email address, the contract document, signing audit trail
Where: AWS UK (London). The provider lets each account choose its contract-storage region; ours is set to London (United Kingdom) as of 2026-09-22.
Transfer tool: UK Addendum to the EU SCCs
When: Only when an institution signs a contract with us
Provider terms: https://esignatures.com/docs/compliance
Verified: Data centre set to London in the account settings on 2026-09-22. The provider's Data Processing Addendum incorporates the ICO UK Addendum (version B1.0, 21 March 2022). Its own sub-processors for email, SMS and payments are US companies, which is why a transfer tool is still listed.

IP geolocation (geojs.io, ipapi.co)

GeoJS; ipapi.co

Purpose: Detects your country from your IP address so the pricing page can show the right currency
Data it receives: IP address only, at the moment the pricing page loads
Where: Global
Transfer tool: UK Addendum to the EU SCCs
When: When the pricing page loads
Note: No identifier other than the IP address is sent and nothing is stored by us beyond the detected country.

OpenAI (not enabled)

OpenAI, L.L.C. (United States)

Purpose: The biomedical AI assistant can use OpenAI as a further fallback, but no OpenAI key is configured and the code path is disabled
Data it receives: None today. If enabled: the text a user types into the assistant, with no account identifier.
Where: United States
Transfer tool: UK Addendum to the EU SCCs
When: Not enabled; listed because the code can call it and this register must not go stale if a key is added
Provider terms: https://openai.com/policies/data-processing-addendum/

Together AI and Replicate

Together Computer, Inc.; Replicate, Inc. (United States)

Purpose: Generates illustration images for articles (an administrator tool)
Data it receives: None. Prompts describe article topics and contain no personal data.
Where: United States
Transfer tool: UK (no transfer)
When: Never triggered by a learner
Note: Listed for completeness; no personal data is involved.

Only with your marketing consent

These advertising pixels never load unless you switch marketing cookies on. See the Cookie Policy.

Google Ads measurement

Google Ireland Ltd / Google LLC

Purpose: Measures whether our Google adverts led to a sign-up or purchase
Data it receives: Advertising cookie id, pages visited, conversion events
Where: United States and other Google regions
Transfer tool: UK-US data bridge (DPF) or UK Addendum
When: Only if you accept marketing cookies
Provider terms: https://business.safety.google/adsprocessorterms/

Meta Pixel

Meta Platforms Ireland Ltd

Purpose: Measures whether our Facebook and Instagram adverts led to a sign-up or purchase
Data it receives: Advertising cookie id, pages visited, conversion events
Where: Ireland and the United States
Transfer tool: UK-US data bridge (DPF) or UK Addendum
When: Only if you accept marketing cookies
Provider terms: https://www.facebook.com/legal/terms/dataprocessing

TikTok Pixel

TikTok Information Technologies UK Ltd / TikTok Technology Ltd (Ireland)

Purpose: Measures whether our TikTok adverts led to a sign-up or purchase
Data it receives: Advertising cookie id, pages visited, conversion events
Where: United States, Ireland, Singapore and Malaysia per TikTok's terms
Transfer tool: UK Addendum to the EU SCCs
When: Only if you accept marketing cookies
Provider terms: https://ads.tiktok.com/i18n/official/policy/business-products-terms

Not sub-processors

Your institution's identity provider (UK Access Management Federation SAML, Microsoft Entra ID or Google Workspace). Operated by your institution as controller; we receive the assertion or token it chooses to send.
YouTube (privacy-enhanced embeds). Videos are embedded from youtube-nocookie.com and load only when you press play.
Google Fonts. Font files are fetched from Google; the request carries your IP address and nothing else.

Questions about this register: [email protected].