Sub-processors: HelpCCMS
Last updated: 3 August 2026.
This page lists the third parties we engage to provide HelpCCMS, what they do, where the data sits, and (where the party is established outside the EEA) the legal basis for that transfer. It is referenced from the privacy policy and from §5 of the data processing agreement.
We notify customers by email of a new or replacement sub-processor, with a 30-day objection period before the change takes effect.
Current sub-processors
| Sub-processor | What they do for us | Data stored in | Transfer basis for the US |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU region | Standard Contractual Clauses |
| Vercel | Application hosting | EU region | EU-US Data Privacy Framework (certified), supplemented by SCCs |
| Stripe | Payments, subscriptions and invoicing | US | EU-US Data Privacy Framework (certified) |
| Postmark (AC PM LLC, part of ActiveCampaign) | Sending transactional email | US | EU-US Data Privacy Framework (certified), supplemented by SCCs |
| Anthropic | AI structuring of content, paid plans only | US | Standard Contractual Clauses |
| Zoho | Our own mailboxes, so any email you send us | EU data centre | Standard Contractual Clauses (intra-group) |
Two things worth knowing
On the Free plan there are no AI features. Content on a Free plan is therefore never passed to an AI sub-processor. This is not a policy promise but a property of the product: the AI paths are closed for that plan.
Supabase and Vercel store our data in an EU region, but both are US companies. Incidental access from the US (for example by support staff) cannot be ruled out, which is what the transfer basis in the table covers.
How we verify this
The transfer basis per party is checked against that party's own published privacy documentation, and against the U.S. Department of Commerce Data Privacy Framework list where certification is claimed. Last verified: 3 August 2026.