Back to Legal

Sub-processors

Last updated: 12 October 2026

A sub-processor is a third-party company that StoneRise engages to process our customers' personal data on their behalf, so that we can provide the StoneRise platform. Our use of sub-processors is governed by our data processing agreement with each customer.

This list was last updated on 12 October 2026. We email each customer's main account contact at least 14 days before we add or replace a sub-processor. To add another contact to these notifications, email office@stonerise.tech.

Current sub-processors

  • Amazon Web Services EMEA SARL(privacy information, opens in a new tab)

    Purpose
    Cloud hosting, database, file storage, email delivery (Amazon SES), document text extraction (Amazon Textract) and AI analysis of contracts and documents (Amazon Bedrock)
    Data processed
    All Customer Data
    Location of processing
    United Kingdom (London, eu-west-2)
    Transfer safeguard
    Not applicable (processed in the UK)

  • Microsoft Ireland Operations Ltd (Microsoft 365 and Entra ID)(privacy information, opens in a new tab)

    Purpose
    Transactional email sending, and single sign-on (SSO) and multi-factor authentication (MFA) through Microsoft Entra ID
    Data processed
    Names, email addresses and notification content; sign-in identifiers and authentication events, including IP address and device details
    Location of processing
    United Kingdom
    Transfer safeguard
    Not applicable (processed in the UK)

  • Functional Software, Inc. (Sentry)(privacy information, opens in a new tab)

    Purpose
    Error monitoring
    Data processed
    Technical error data, which may include user IDs and request details
    Location of processing
    European Union (Germany)
    Transfer safeguard
    UK adequacy regulations (EEA)

  • Atlassian Pty Ltd (Jira)(privacy information, opens in a new tab)

    Purpose
    In-app feedback and support tickets
    Data processed
    Feedback content, screenshots, user name and email address, browser details
    Location of processing
    United Kingdom
    Transfer safeguard
    Not applicable (processed in the UK)

  • Twilio Inc.(privacy information, opens in a new tab)

    Purpose
    SMS delivery (for example, sign-in verification codes)
    Data processed
    Mobile phone numbers and message content
    Location of processing
    European Union (Ireland)
    Transfer safeguard
    UK adequacy regulations (EEA)

  • Stripe Payments UK, Ltd(privacy information, opens in a new tab)

    Purpose
    Subscription billing
    Data processed
    Billing contact details and payment information
    Location of processing
    United States (Stripe, LLC), and other countries where Stripe affiliates and sub-processors operate
    Transfer safeguard
    UK–US Data Bridge (Stripe, LLC is certified under the UK Extension to the EU–US Data Privacy Framework)

  • Google LLC (reCAPTCHA)(privacy information, opens in a new tab)

    Purpose
    Bot protection on public registration forms
    Data processed
    IP address, browser and device signals
    Location of processing
    United States
    Transfer safeguard
    UK–US Data Bridge (Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework)

  • HubSpot, Inc.(privacy information, opens in a new tab)

    Purpose
    Customer relationship management (CRM), including contract and account records, and website enquiry forms
    Data processed
    Names, business contact details and job titles of customer contacts; company details; contract and account records; enquiry form submissions
    Location of processing
    European Union (Germany)
    Transfer safeguard
    UK adequacy regulations (EEA); any US access is covered by the UK–US Data Bridge (HubSpot, Inc. is certified under the UK Extension to the EU–US Data Privacy Framework)

Questions

If you have questions about our sub-processors, email office@stonerise.tech.