Vendor list
Active subprocessors
| Provider | Purpose | Data processed | Location | DPA | Transfer basis | Category |
|---|---|---|---|---|---|---|
| VPS Hosting Provider | Website hosting and application runtime | Website data, server logs, uploaded files | United States | Pending | SCCs | Hosting |
| Brevo (Sendinblue) | Transactional and marketing email delivery | Email address, name, message content | France / EU | Yes | Adequacy (EU) | |
| Keycloak (self-hosted) | Authentication and identity management | Email, name, authentication tokens | VPS (US) | N/A (self-hosted) | Internal | Auth |
| PostgreSQL (self-hosted) | Database for project submissions and records | Form submissions, project data, audit logs | VPS (US) | N/A (self-hosted) | Internal | Database |
| Airtable | Project management and record keeping | Project brief data, client contact details | United States | Yes | SCCs | CRM / PM |
| Cloudflare | DNS, CDN, and DDoS protection | IP addresses, HTTP metadata, logs | United States | Yes | SCCs | Infrastructure |
We do not list vendors solely as links or advertisers on this website, such as social media platforms you choose to visit via links. Those platforms operate as independent data controllers when you visit their sites.
We will notify clients of material changes to this subprocessor list, and provide at least 10 days notice before engaging a new subprocessor where required by client agreements.
Last updated: June 2026