Last updated: 17 September 2026

Our sub-processors

We work with a small number of trusted third-party providers to help us deliver the Tendr Platform reliably and securely. These providers are known as sub-processors because, in some cases, they handle limited personal data on our behalf and on behalf of our clients and their employees (for example, to host our cloud infrastructure, send notification emails or process payments).

We carefully select and review all of our sub-processors. Each is contractually bound to data protection and security standards consistent with the UK GDPR and EU GDPR, acts only on our instructions, and is covered by a written data processing agreement. Where a sub-processor processes personal data outside the UK, we rely on a lawful transfer mechanism, which is shown for each provider in the table below. The mechanisms we use are:

• UK adequacy regulations – transfers to countries the UK has found adequate, including the EEA and New Zealand.
• UK Extension to the EU–US Data Privacy Framework (the "UK–US Data Bridge") – transfers to US organisations that have self-certified to the UK Extension. We check each provider's certification on the US Department of Commerce Data Privacy Framework List and record the date of the check.
• UK International Data Transfer Addendum to the EU Standard Contractual Clauses ("UK Addendum") – incorporated in the provider's data processing agreement, and used where no adequacy decision applies or as a fallback.

Where your data is hosted

Production data for the Tendr Platform, including databases and backups, is hosted by Amazon Web Services in the United Kingdom (London region, eu-west-2). Backups are stored in the same region. We will notify clients of any change to the hosting or backup location in accordance with their Data Processing Agreement.

Current sub-processors

AWS GDPR Data Processing Addendum (EU SCCs with UK Addendum) covers any residual remote support access from outside the UK. | | AI model hosting | Amazon Web Services EMEA SARL (Amazon Bedrock) | Hosting of the AI models that power the Platform's AI features (for example, data reconciliation and assistant tools); prompts and outputs are processed for inference only | United Kingdom (AWS London region, eu-west-2) | Not required for UK processing. Cross-region inference is not enabled, so requests are not routed outside the UK. Covered by the AWS GDPR Data Processing Addendum.

See note 5. | | Payment processing | Stripe Payments UK Limited, with Stripe, LLC (United States) | Card payment processing and transaction settlement for purchases made through the Platform | United Kingdom; EU/EEA; United States | EEA: UK adequacy regulations.

United States: UK Extension to the EU–US Data Privacy Framework (Stripe, LLC is certified); Stripe Data Processing Agreement (EU SCCs with UK Addendum) as fallback.

See note 1. | | Open banking payments | TrueLayer Limited (authorised by the FCA, FRN 901096) | Open banking connections and bank-to-bank payments | United Kingdom; EU/EEA | Not required for UK processing.

EEA: UK adequacy regulations.

See note 1. | | Gift card fulfilment | Tillo Ltd | Sourcing and fulfilment of digital gift cards | United Kingdom | Not required (UK processing only).

See note 2. | | Gift card fulfilment | Blackhawk Network EMEA Limited | Sourcing and fulfilment of digital gift cards | United Kingdom; EU/EEA | Not required for UK processing.

EEA: UK adequacy regulations.

See note 2. | | Gift card fulfilment | Runa Network Limited (formerly WeGift) | Sourcing and fulfilment of digital gift cards | United Kingdom | Not required (UK processing only).

See note 2. | | Product analytics | Mixpanel, Inc. (EU Data Residency programme) | Product analytics. Receives anonymised analytics events only; see note 6. | EU (Frankfurt, Germany); limited support access from the United States | EEA: UK adequacy regulations.

United States: UK Extension to the EU–US Data Privacy Framework (Mixpanel, Inc. is certified); Mixpanel Data Processing Agreement (EU SCCs with UK Addendum) as fallback. | | Internal collaboration and support tools | Slack Technologies, LLC (a Salesforce company) | Internal communications and support-ticket collaboration; tickets may include the user details needed to resolve a support request | United States | United States: UK Extension to the EU–US Data Privacy Framework (Slack Technologies, LLC is a covered entity under Salesforce's certification); Slack Data Processing Addendum (EU SCCs with UK Addendum) as fallback.

See note 3. | | Internal collaboration and support tools | Atlassian Pty Ltd and Atlassian US, Inc. (Trello) | Support-ticket tracking and internal task collaboration; tickets may include the user details needed to resolve a support request | United States; Australia (support access) | United States: UK Extension to the EU–US Data Privacy Framework (Atlassian is certified).

Australia and fallback: Atlassian Data Processing Addendum (EU SCCs with UK Addendum).

See note 3. | | Internal collaboration and support tools | Microsoft Ireland Operations Limited | Internal document collaboration, storage and communications; documents and messages may include client and user personal data handled in the course of providing the Services | United Kingdom (Tendr's Microsoft 365 tenant is set to the UK, so core service data is stored in Microsoft's UK data centres); EU (Ireland, Netherlands) for identity and directory services; United States for support and certain services | EEA: UK adequacy regulations.

United States: UK Extension to the EU–US Data Privacy Framework (Microsoft Corporation is certified); Microsoft Products and Services Data Protection Addendum (EU SCCs with UK Addendum) as fallback.

See note 3. | | Error monitoring | Functional Software, Inc. (trading as Sentry) | Application error tracking and performance monitoring; error reports may include the user and session details needed to diagnose a fault, and are used only to support and secure the Platform. | EU (Sentry EU region); limited support access from the United States | EEA: UK adequacy regulations.

United States: UK Extension to the EU–US Data Privacy Framework (Functional Software, Inc. is certified); Sentry Data Processing Addendum (EU SCCs with UK Addendum) as fallback. | | Email delivery | Twilio Inc. (SendGrid) | Transactional and notification email delivery (recipient name, email address and message content) | United States | United States: UK Extension to the EU–US Data Privacy Framework (Twilio Inc. is certified); Twilio Binding Corporate Rules and EU SCCs with UK Addendum as fallback. | | Finance and invoicing | Xero (UK) Limited, with Xero Limited (New Zealand) | Client invoicing, billing records and financial administration | New Zealand; Australia; United States | New Zealand: UK adequacy regulations.

Australia and United States: Xero Data Processing Addendum (EU SCCs with UK Addendum).

See note 4. |

Notes

1. Payment providers. Stripe and TrueLayer are regulated payment institutions. They process card and bank payment data as independent controllers under their own terms, for payment regulation, security and fraud-prevention purposes. They are listed here because they also handle limited order and account data on our behalf.
2. Gift card providers. We share only the data needed to issue and deliver a gift card, such as the order reference, product and value. These providers do not receive broader user account data.
3. Collaboration and support tools. These tools do not connect to the Tendr Platform's production databases. Personal data reaches them only where a Tendr team member records it in a support ticket, message or document in order to resolve a client or user request. Access is limited to authorised Tendr personnel under role-based permissions and multi-factor authentication.
4. Xero processes the contact and billing details of client personnel that we hold in our own capacity as a controller for managing the client relationship. It does not process Platform user data. It is included here for completeness.
5. AI models (Amazon Bedrock). Our AI features run on models hosted within our own AWS environment through Amazon Bedrock. Amazon Bedrock does not store or log prompts and outputs, does not use them to train any models, and the underlying model providers have no access to them. No personal data is sent to any third-party AI provider outside AWS.
6. Product analytics (Mixpanel). Analytics events are anonymised before they leave the Platform: they carry no user, tenant or session identifier and no key that would allow an event to be linked back to an individual. Mixpanel is listed here for completeness and because it provides limited support access from the United States.
7. Data Privacy Framework certifications were last verified on the Data Privacy Framework List at dataprivacyframework.gov on 17 September 2026.

Updates to this list