Sub-processors
Last updated: August 2026
This is the full list of sub-processors we use to provide Komply, referenced from our Data Processing Agreement and our Privacy Policy. It is your general written authorisation for us to use them — see the DPA, section 6, for what that means and how we handle a new one.
Suppliers who process data for us
- Supabase — database, authentication, and file storage. UK (London).
- Vercel — application hosting and content delivery. Server-side requests are processed in the United States.
- Sentry — error monitoring. European Union (Germany).
- Upstash — two separate services under one supplier: the background job queue (European Union), which receives record identifiers only, never document contents; and rate limiting (UK, London), which receives IP addresses for sign-in and account-creation attempts.
- Stripe— payment processing. Processed per Stripe's own published data processing terms: stripe.com/legal/dpa.
- Resend— transactional email delivery. Processed per Resend's own published data processing terms: resend.com/legal/dpa.
- Anthropic— generates your action plan and Section 7 statements from your assessment answers. Processed per Anthropic's own published data processing terms: anthropic.com/legal/data-processing-addendum.
- Voyage AI — generates the search embeddings that retrieve relevant statutory guidance for your action plan and Section 7 statements; receives question and guidance text, not your venue or assessment data.
- VirusTotal(Google) — checks uploaded evidence files against its known-malware database by cryptographic hash; the file itself is never sent. Processed per Google's own published terms for this service: cloud.google.com/terms/secops/privacy-notice.
Contact
Questions about this list: info@komply.uk