Legal · last updated August 2026
These are the third parties Vantra uses to run the product, what each one does, and where they process data. Under the data processing agreement we tell customers before this list changes, so there is time to object.
| Sub-processor | What it does | Where it processes | Terms |
|---|---|---|---|
| Supabase | Managed Postgres database, authentication and file storage. Holds event records, staff records and account data. | United Kingdom (London region) | Their terms |
| Cloudflare | Application hosting, edge delivery and DNS. Processes requests in transit; does not store event records. | United Kingdom edge, with global routing | Their terms |
| Resend | Transactional email: sign-in links, screening invitations, shift offers and exported reports sent by a customer. | European Union and United States | Their terms |
Event records, staff records and account data are held in the United Kingdom. Where a sub-processor operates outside the UK, that is stated in the table above and the transfer is covered by the UK international data transfer addendum to the European Commission's standard contractual clauses.
We give customers at least 30 days' notice before adding a sub-processor that handles customer data, and a customer may object in that period. Removals and changes of purpose are published here on the day they take effect.
Leave an address and we will email you when this page changes. It is used for nothing else, and you can ask to be removed at any time.