Vendor list

Active subprocessors

Provider Purpose Data processed Location DPA Transfer basis Category
VPS Hosting Provider Website hosting and application runtime Website data, server logs, uploaded files United States Pending SCCs Hosting
Brevo (Sendinblue) Transactional and marketing email delivery Email address, name, message content France / EU Yes Adequacy (EU) Email
Keycloak (self-hosted) Authentication and identity management Email, name, authentication tokens VPS (US) N/A (self-hosted) Internal Auth
PostgreSQL (self-hosted) Database for project submissions and records Form submissions, project data, audit logs VPS (US) N/A (self-hosted) Internal Database
Airtable Project management and record keeping Project brief data, client contact details United States Yes SCCs CRM / PM
Cloudflare DNS, CDN, and DDoS protection IP addresses, HTTP metadata, logs United States Yes SCCs Infrastructure

We do not list vendors solely as links or advertisers on this website, such as social media platforms you choose to visit via links. Those platforms operate as independent data controllers when you visit their sites.

We will notify clients of material changes to this subprocessor list, and provide at least 10 days notice before engaging a new subprocessor where required by client agreements.

Last updated: June 2026