Subprocessor List
Effective
This page lists the third parties Indacas Ltd (company number 17340475) engages to process personal data in providing the Platform, as authorised under Section 5 of the Data Processing Agreement. "Data categories" indicates whether a provider touches Account Data (Indacas as controller), Research Data (Indacas as processor), or both.
Current subprocessors
| Provider | Purpose | Data categories | Location of processing | Transfer safeguard |
|---|---|---|---|---|
| DigitalOcean, LLC | Cloud infrastructure — compute, managed PostgreSQL database, object storage, networking and backups. Primary data store. | Account Data and Research Data (including any special-category data collected in studies) | London (LON1), United Kingdom. DigitalOcean is US-incorporated; any support access from outside the UK is governed by the safeguard opposite | UK International Data Transfer Addendum to the EU Standard Contractual Clauses, under DigitalOcean's Data Processing Agreement, which is incorporated into its Terms of Service |
| AC PM LLC (Postmark) | Transactional email delivery — address verification, invitations, and account and study notifications | Account Data only: the recipient's email address, their name where a template uses it, and the notification text itself. Survey questions, survey responses and participant record fields are never sent to this provider | United States | UK International Data Transfer Addendum to the EU Standard Contractual Clauses (Modules Two and Three), under the Postmark Data Processing Agreement, which is incorporated into its Terms of Service. AC PM LLC is additionally certified under the EU–US Data Privacy Framework |
| Cloudflare, Inc. | DNS, reverse proxy and DDoS protection; traffic to the Platform transits Cloudflare before reaching our origin | Metadata for all traffic (IP addresses, request URLs). Cloudflare terminates the browser's TLS session and re-encrypts to our origin, so request and response contents pass through it in the clear and may include Account Data and Research Data | United Kingdom. Cloudflare Regional Services (UK region) restricts TLS termination and inspection of request and response contents to Cloudflare data centres in the United Kingdom. Cloudflare's own service metadata may be processed globally | UK International Data Transfer Addendum to the EU Standard Contractual Clauses, under Cloudflare's Data Processing Addendum, which is incorporated into its Terms of Service |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payment processing for subscriptions | Account Data only: billing contact, subscription details and payment history. Payment card data is collected and held by Stripe and never reaches Indacas | Ireland (Stripe Payments Europe, Ltd.), with support and fraud processing in the United States (Stripe, Inc.) | Ireland is covered by the UK adequacy regulations for the EEA. Processing in the United States is under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, under Stripe's Data Processing Agreement, which is incorporated into its Services Agreement |
Internal infrastructure (not subprocessors)
These run on Indacas-controlled infrastructure and involve no third-party processing of personal data:
- Ory Kratos (self-hosted) — identity and authentication. Software only; identity data stays on our infrastructure.
- Grafana / Loki (self-hosted) — logging and monitoring. Log data (which can include IP addresses and user identifiers) remains on our infrastructure.
Changes to this list
Before adding or replacing a subprocessor that processes Research Data, we will update this list and notify Researcher account holders at least 30 days in advance, by email to account administrators. Researchers may object as set out in Section 5 of the Data Processing Agreement.
Questions: [email protected].