Sub-Processor Register
Last updated: September 2026
A complete list of the third-party sub-processors that ScopeKit engages to process personal data on behalf of our customers, in accordance with UK GDPR (as amended by the Data Use and Access Act 2025) Article 28.
1. Overview
As a data processor, ScopeKit may engage third-party sub-processors to assist in providing our services. Under UK GDPR (as amended by the Data Use and Access Act 2025) Article 28, we are required to maintain a register of all sub-processors and to inform our customers of any intended changes.
This register lists every sub-processor, including the nature of the processing they perform, the categories of personal data they may access, where processing takes place, and how they are engaged. For full details of our data processing obligations and safeguards, please refer to our Data Processing Agreement.
2. Current Sub-Processors
The When engaged column distinguishes vendors that are always in the data path from those only engaged when you connect a specific integration or give a specific consent.
| Sub-Processor | Purpose | Data Processed | Location / Region | When Engaged |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, file storage, authentication (Cognito), transactional email (SES) and SMS (SNS) | All platform data: user accounts, employee and customer records, project and quote records, uploaded documents and photographs, and the contents of transactional messages | United Kingdom (London, eu-west-2) | Always engaged |
| Elastic Cloud | Search and analytics engine; the primary data store | Indexed copies of platform data, including customer records, quotes, projects, timesheets and audit logs | United Kingdom (London, eu-west-2, hosted on AWS) | Always engaged |
| Stripe | Subscription billing and payment processing | Billing contact details, tokenised payment card information, invoicing records and subscription data | European Union and United States (EU data residency; Data Privacy Framework) | Always engaged |
| Sentry | Error monitoring and performance tracing | Application error reports, performance metrics, device and browser metadata; may incidentally include user identifiers or IP addresses | United States (Standard Contractual Clauses and UK IDTA in place) | Always engaged |
| PostHog | Product analytics and feature-flag delivery | Page views, feature usage events, an anonymous device identifier and organisation identifier | European Union (EU Cloud, eu.posthog.com) | Only with your analytics-cookie consent |
| Anthropic | AI quote drafting, document analysis and the in-product assistant | Site photographs, project descriptions, measurements, specifications and document text submitted for analysis. Not retained by the provider for model training. | United States (Standard Contractual Clauses and UK IDTA in place) | Always engaged |
| OpenAI | AI text generation and document extraction | Project descriptions, specifications and document text submitted for analysis. Not retained by the provider for model training. | United States (Standard Contractual Clauses and UK IDTA in place) | Always engaged |
| Google (Gemini) | AI image and document analysis | Site photographs and document text submitted for analysis. Not retained by the provider for model training. | United States (Standard Contractual Clauses and UK IDTA in place) | Always engaged |
| Google Maps Platform | Address lookup, geocoding and mapping | Site and customer addresses submitted for lookup, map tile requests; may include IP addresses and approximate location | Global (Google Cloud; Standard Contractual Clauses in place) | Always engaged |
| Twilio | SMS delivery | Recipient phone numbers and the contents of SMS notifications | European Union and United States (Standard Contractual Clauses in place) | Only when you connect the integration |
| Vonage (Ericsson) | SMS delivery (alternative provider) | Recipient phone numbers and the contents of SMS notifications | European Union and United States (Standard Contractual Clauses in place) | Only when you connect the integration |
| Esendex | SMS delivery (alternative provider) | Recipient phone numbers and the contents of SMS notifications | United Kingdom | Only when you connect the integration |
| Meta Platforms Ireland Limited (WhatsApp) | WhatsApp notification delivery | Recipient mobile numbers, recipient names as used in the message, message content (job assigned, schedule changed or cancelled), and delivery and read status. Sent only to workers who have opted in. | Ireland, with onward transfers to the United States (EU-US Data Privacy Framework and UK Extension, Standard Contractual Clauses) | Only when you connect the integration |
| Xero | Accounting integration | Invoices, credit notes, customer and supplier contact details, and payment records synchronised to your accounting ledger | New Zealand, Australia and United States (adequacy decision for New Zealand) | Only when you connect the integration |
| Intuit QuickBooks | Accounting integration | Invoices, customer and supplier contact details, and payment records synchronised to your accounting ledger | United States (Standard Contractual Clauses in place) | Only when you connect the integration |
| Microsoft (Graph and Power BI) | Calendar and mailbox integration, and reporting exports to Power BI | Calendar events, message metadata, and the report datasets you choose to publish | European Union and United Kingdom (EU Data Boundary) | Only when you connect the integration |
| Slack | Internal ScopeKit staff notifications (sales enquiries and operational alerts) | The name, email address, telephone number and company of somebody who submits an enquiry through our website | European Union and United States (Data Privacy Framework) | Always engaged |
3. International Transfer Safeguards
Where personal data is transferred outside the United Kingdom, ScopeKit ensures that appropriate safeguards are in place in accordance with UK GDPR Article 46, including:
UK Adequacy Decisions — transfers to countries or territories that the UK Secretary of State has determined provide an adequate level of data protection.
International Data Transfer Agreement (IDTA) — the UK's replacement for Standard Contractual Clauses, as approved by the ICO.
Standard Contractual Clauses (SCCs) — EU Commission-approved clauses with the UK Addendum where applicable.
Supplementary measures — additional technical and organisational safeguards such as encryption in transit and at rest, pseudonymisation, and access controls.
4. Changes to Sub-Processors
ScopeKit will provide at least 30 days' prior written notice before engaging any new sub-processor or replacing an existing one. Customers who have entered into a Data Processing Agreement with us will be notified directly of any proposed changes.
If you object to a new or replacement sub-processor on reasonable data protection grounds, please contact us within 14 days of receiving notice. We will work with you in good faith to find a mutually acceptable resolution. If no resolution can be reached, you may terminate the affected services without penalty.
5. Due Diligence
Before engaging any sub-processor, ScopeKit carries out a thorough due diligence assessment to ensure that the sub-processor:
- Can provide sufficient guarantees to implement appropriate technical and organisational measures in accordance with UK GDPR.
- Holds relevant security certifications (e.g. ISO 27001, SOC 2, PCI DSS) where applicable.
- Has appropriate data processing agreements and international transfer mechanisms in place.
- Can meet data deletion and return obligations upon termination.
6. Contact
If you have any questions about our sub-processors, wish to be notified of future changes, or would like to raise an objection, please contact our Data Protection Officer:
Data Protection Officer
Email: legal@scopekit.co.uk
ScopeKit, 55 Hoghton Street, Southport, Merseyside, PR9 0PG, United Kingdom
Company No. 16168944
For our full privacy practices, please see our Privacy Policy and Data Processing Agreement.