Sub-processor list
The companies that handle personal data for us: for our own website, accounts and billing, and for the SecondShadow product, where they work on our customers' behalf.
Last updated 14 October 2026
What this page is
A sub-processor is a company we use that handles personal data as part of the work it does for us. We stand in two different positions, so the list comes in two parts.
- Our website, accounts, sign-in and billing. Here we decide what happens to the data: we are the controller, and these companies are our processors. What we collect and why is in the privacy policy.
- The SecondShadow product. The records your company keeps in a workspace belong to your company. We process them on its behalf, and the companies in this part help us do it.
We update this page before a new company starts handling personal data for us, or before one we already use starts doing something new with it. That is how we work rather than a notice period in a contract.
In the Transfers column, data bridge means the UK Extension to the EU-US Data Privacy Framework, under which the UK treats a certified US company as giving adequate protection. SCCs and UK Addendum means the EU standard contractual clauses with the Information Commissioner's addendum for UK data, as part of that company's data processing terms.
Our website, accounts and billing
| Who | What for, and what it handles | Where | Transfers |
|---|---|---|---|
| SupabaseSupabase Pte. Ltd. | Our database and sign-in system: your account, your billing details and everything else this website stores | London (UK). Supabase is a Singapore company, with a US affiliate for support | Stored in the UK. Supabase's own access from outside it: SCCs and UK Addendum |
| VercelVercel Inc. | Hosting this website, including request logs that contain IP addresses | Global network, US company | Data bridge; SCCs and UK Addendum |
| ResendPlus Five Five, Inc., trading as Resend | Sending our email, from mail.secondshadow.com: the recipient's address and name, and the message | US | Data bridge; SCCs and UK Addendum |
| CloudflareCloudflare, Inc. | DNS for our domains, and the sign-in check in front of our staff console, which sees only our own staff | Global network, US company | Data bridge; SCCs and UK Addendum if that lapses |
| GoogleGoogle Ireland Limited, for Analytics | Analytics and Tag Manager, only if you agree to analytics cookies: identifiers, a shortened IP address, and the pages and events of your visit | US / global | Data bridge; SCCs and UK Addendum if that lapses |
| GoogleGoogle Cloud EMEA Limited, under Google Workspace | The demo-booking calendar, only if you load it: the name, email and notes you type into it, and the slot you choose | US / global | Data bridge |
| CookieYesCookieYes Limited | Recording your cookie choice: an id for it, what you chose, when, and your IP address | Ireland and the UK. CookieYes is a UK company | None needed: the UK treats Ireland, as part of the EEA, as giving adequate protection |
| StripeStripe Payments Europe, Limited | Card payments, subscriptions and invoices: the billing contact's name and email, billing address, VAT number, plan and seats. Your card goes straight to Stripe and never reaches us. Stripe also screens payments for fraud, and for that it acts as a separate controller under its own privacy policy | US / EU | Data bridge; SCCs and UK Addendum if that lapses |
What our own page counter collects on this website is kept in the SecondShadow product, so the companies that run the product, in the next part, handle it too.
The SecondShadow product
Everything in your company's workspace: its customers and contacts, deals, quotes and orders, activities, logged emails, website visits, the audit trail and the people who use it.
Always in use
| Who | What for, and what it handles | Where | Transfers |
|---|---|---|---|
| Amazon Web ServicesAmazon Web Services EMEA SARL | Hosting: every part of the product, its queues and short-lived caches, file storage for attachments, quote PDFs and exports, its logs and its secrets. It holds all workspace data at rest except the database. The logs carry no email bodies, tokens or amounts of money | London (UK). The content delivery network and its firewall run at a global edge: they serve the web app and receive website-tracker events | Stored in the UK. Outside it, including the edge: SCCs and UK Addendum, and the data bridge |
| SupabaseSupabase Pte. Ltd. | The product's database, and its original sign-in. It holds every workspace record: customers, contacts, deals, quotes and orders with their amounts, activities, logged emails, website visits, the audit trail and user accounts | London (UK). Supabase is a Singapore company, with a US affiliate for support | Stored in the UK. Supabase's own access from outside it: SCCs and UK Addendum |
| AnthropicAnthropic Ireland, Limited | Photon, the product's AI. It receives the records a Photon request reads, which can include names, email addresses, deal and quote details and activity notes, and what the person typed | US, where it is stored. No regional setting is made, so a request may also be handled in Anthropic's other regions | SCCs and UK Addendum |
| Mailgun | Email. It sends quotes, invitations, notifications and follow-ups, each with the recipient's address and the content, and receives the replies that come back to them | EU (Germany and Belgium). Mailgun is part of Sinch | Data bridge; SCCs and UK Addendum |
| SentryFunctional Software, Inc., trading as SentryFrom the 0.15.0 release | Error monitoring, application logs and uptime. It never collects who a user is, cookies, request bodies, query strings or local variables. Email addresses, tokens, keys, IP addresses, amounts of money and names are removed before anything is sent, and anything that cannot be cleaned is dropped | EU (Frankfurt, Germany). Sentry may access it from the US | Data bridge; SCCs and UK Addendum if that lapses |
Only if your workspace connects it
| Who | What for, and what it handles | Where | Transfers |
|---|---|---|---|
| XeroXero (UK) Limited, for a UK subscriber | Accounting sync, once a workspace admin connects your company's own Xero organisation. It receives orders as invoices, with your customer's company and contact details and the line amounts, and the product reads back invoice status and payments. What reaches Xero is then held under your company's own agreement with Xero | US (Xero hosts on Amazon Web Services) | SCCs and UK Addendum, in Xero's data processing terms |
Questions
If you want to know more about any company on this page, or how we checked it, email contact@secondshadow.com. For anything security-related, email security@secondshadow.com.