Sub-processors
Last updated: October 2026
This is the full list of sub-processors we use to provide Komply, referenced from our Data Processing Agreement and our Privacy Policy. It is your general written authorisation for us to use them. See the DPA, section 6, for what that means and how we handle a new one.
Suppliers who process data for us
- Supabase: database, authentication, and file storage. UK (London).
- Vercel: application hosting, content delivery and cookieless visit counts on public pages. Server-side requests are processed in the United States.
- Sentry: error monitoring. European Union (Germany).
- Upstash: two separate services under one supplier (the background job queue (European Union), which receives record identifiers only, never document contents; and rate limiting (UK, London), which receives IP addresses for sign-in and account-creation attempts).
- Stripe: payment processing. Processed per Stripe's own published data processing terms: stripe.com/legal/dpa.
- Resend: transactional email delivery. Processed per Resend's own published data processing terms: resend.com/legal/dpa.
- Anthropic: generates your action plan and Section 7 statements from your assessment answers. Processed per Anthropic's own published data processing terms: anthropic.com/legal/data-processing-addendum.
- Voyage AI: generates the search embeddings that retrieve relevant statutory guidance for your action plan and Section 7 statements; receives question and guidance text, not your venue or assessment data.
- VirusTotal (Google): checks uploaded evidence files against its known-malware database by cryptographic hash; the file itself is never sent. Processed per Google's own published terms for this service: cloud.google.com/terms/secops/privacy-notice.
Contact
Questions about this list: info@komply.uk