Sub-processors
Draft — pending legal review. This list reflects the vendors AuditCrow currently uses to deliver the service. It is not yet backed by signed Art. 28 sub-processor agreements or completed international-transfer paperwork for every vendor below — see the transfer-basis column.
4D Services Limited is the processor for personal data you or your agency submit to AuditCrow. We use the sub-processors listed below to deliver the service. Each is engaged under confidentiality and data-protection terms, and only processes data on our instructions.
Advance notice of changes
We will give at least 14 days' notice before adding a new sub-processor that will process your personal data, so you have an opportunity to object under your Data Processing Agreement.
Currently in use
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Supabase | Database, storage & secrets vault | UK (eu-west-2, London) | No transfer — UK storage |
| Clerk | Authentication & session management | United States | UK Extension to EU-US DPF (self-certified) |
| Anthropic | AI-generated audit content & personas | United States | SCCs (DPF status disputed across sources — verify directly before relying on it) |
| OpenAI | AI-generated audit content (optional models) | United States | UK Extension to EU-US DPF (verify current listing) |
| Firecrawl | Website crawling for audits | United States | DPA available, not confirmed DPF-listed — IDTA recommended pending confirmation |
| DataForSEO | SEO & keyword data | United States / European Union | Not found on DPF list — IDTA recommended |
| Search Console, Analytics, Business Profile & PageSpeed connectors | United States | UK Extension to EU-US DPF | |
| Microsoft Clarity | Session behaviour analytics | United States | UK Extension to EU-US DPF |
| Inngest | Background job orchestration | United States | Not found on DPF list — IDTA recommended |
| Vercel | Application hosting | United States | UK Extension to EU-US DPF (confirmed via Vercel's own changelog) |
| Brevo | Transactional & marketing email | European Union (France) | No transfer — EU/EEA |
| Stripe | Billing & payment processing | United States | UK Extension to EU-US DPF (self-certified) |
Planned (not yet live)
| Sub-processor | Purpose | Location |
|---|---|---|
| Trustpilot | Review signal ingestion (planned) | European Union |
| VouchedFor | Adviser review signal ingestion (planned, Amplifi) | United Kingdom |
| Companies House | Company data lookup (planned) | United Kingdom |
| Company/brand presence signal (planned) | United States |
Questions about a specific sub-processor or an international-transfer mechanism? Contact privacy@4dservices.co.uk.