Subprocessor Register
Last updated: 12 August 2026
This Register identifies third parties Affirmed engages as subprocessors to process Client Personal Data on Affirmed's behalf under Article IV of the Affirmed Legal Framework. It does not list suppliers used solely for Affirmed's independent-controller activities or third parties acting as independent controllers.
The contractual rules governing authorisation, provider changes, objections, contracting and responsibility are contained exclusively in clause 28 of the Legal Framework. This Register records changing provider facts; it is a Notice, not a separate contract. The date in each entry is the date the provider was first listed in this public Register, not necessarily the date Affirmed first used the service.
Only products currently used as subprocessors for Client Personal Data are listed. An AI service whose provider independently determines some purposes and essential means is not listed merely because the Client authorises disclosure to it under clause 26.4; those services are disclosed separately in the Privacy Notice.
| Provider and product | Processing purpose and Client Personal Data | Processing or storage location and transfer mechanism | Applicable Affirmed service and register date |
|---|---|---|---|
| Supabase, Inc. — database, authentication, storage and realtime services | Operates core app records used to deliver the Services. Client Personal Data may include workspace content, campaign, CRM, conversion and connected-account data, OAuth tokens, Client-supplied materials, AI conversations and file metadata. | Primary Affirmed project in London, UK (AWS eu-west-2); limited support and subprocessors may operate globally. Current DPA incorporates EU SCCs and the UK Addendum where required. | Affirmed app and managed-service delivery. Listed 11 August 2026. |
| Vercel Inc. — hosting, serverless execution and content delivery | Hosts and executes app routes through which Client Personal Data is transmitted or processed. Data may include Client content submitted through the app and related request, IP, header, session, log and technical metadata. | Primary processing facilities in the United States, with global edge and backup infrastructure. Current DPA incorporates SCCs and UK transfer terms where required. | Affirmed app and managed-service delivery. Listed 11 August 2026. |
| Google Cloud EMEA Limited — Google Workspace and Drive | Stores and transfers Client working files, attachments, campaign exports, audits, media, recordings, reports and other Client materials placed in Affirmed-managed Drive locations. | Google's global infrastructure; the precise storage or processing location depends on Workspace configuration and feature. UK adequacy applies to qualifying EEA processing; Google's Cloud DPA incorporates SCCs and UK transfer terms for restricted onward transfers. | Document storage, collaboration, reporting and managed-service delivery. Listed 11 August 2026. |
| OpenAI OpCo, LLC — OpenAI API | Supports AI-assisted research, analysis, reporting, quality assurance and workflow. Data may include prompts, responses, documents, images, business context, campaign or performance information, workspace identifiers and limited personal data contained in necessary Client materials. | United States and global subprocessor locations. OpenAI's DPA incorporates processor-to-subprocessor SCCs and the UK Addendum for restricted transfers. | Alfie, analysis, reporting and AI-assisted service delivery. Listed 11 August 2026. |
| Functional Software, Inc., trading as Sentry — error and performance monitoring | Detects, diagnoses and helps secure faults in the app. Data may include exceptions, stack traces, routes, performance events, logs and attached technical context; Affirmed disables default PII collection and does not intentionally send OAuth tokens. | Affirmed's service data is hosted in Germany; limited support and subprocessors may operate elsewhere. UK adequacy applies to qualifying EEA processing; the UK Extension to the EU-US Data Privacy Framework or SCCs and the UK Addendum apply where required. | App monitoring, reliability and security. Listed 11 August 2026. |
Client-owned Google Ads, Analytics, Tag Manager, Merchant Center and similar connected platforms are not listed merely because Affirmed accesses them for the Client. They may act as independent controllers or as providers appointed directly by the Client. Controller-side suppliers, including payment and website analytics providers, are described in the Privacy Notice instead.
Questions about this Register may be sent to louis@affirmed.co.