Legal
Sub-processors
This is a draft and requires legal review before launch. It was written to be honest and usable rather than to be comprehensive, and it has not been checked by a solicitor. It is not in force, because the service is not yet being sold.
If you are relying on this for a real decision, write to [email protected] and ask us where it stands.
Last updated . A UK company is being incorporated to operate this product
Every third party that could process data on our behalf, what they do, and where they do it. This is the complete list, not a selection.
| Who | What they do | Where | Personal data |
|---|---|---|---|
| Neon | Managed PostgreSQL database — all customer data | London, United Kingdom (aws-eu-west-2) | Names, email addresses, password hashes, hashed IP addresses |
| Resend | Transactional email only — address confirmation, password reset, invitations and security notices | European Union | Email addresses and the contents of those messages |
| Anthropic | The documentation chat widget on our public pages. It answers only from our published documentation. No account, click or customer data is sent, and nothing is stored | United States | Only whatever a visitor chooses to type into the question box on a public documentation page |
| GitHub | Source code hosting and continuous integration. No customer data: the test database is created and destroyed inside each run | United States | None |
What is deliberately absent
There is no analytics provider, no advertising network, no session recording, no customer data platform and no third-party support desk. We run no third-party JavaScript on this website at all — the Content Security Policy would refuse it if we tried.
That is not permanent virtue; it is what a small product looks like. Our rule is that an addition has to be able to process data in the UK or EU, and will appear on this page before it starts. There is one exception to that rule and it is the third note below, because an exception you have to go looking for is not really disclosed.
Three notes on the list above
Resend is configured and ready but is not sending in anger yet, because there are no customers. In development, email is printed to a terminal and never leaves the machine.
GitHub is in the United States and is on this list for completeness rather than because it touches your data. It holds the source code. The database used by our automated tests is created empty inside each run and destroyed with it; no customer data is ever copied there.
Anthropic is in the United States, and is the one entry that does not meet our own UK-or-EU rule. It powers the question box at the bottom of our documentation pages, and it receives two things: the question somebody typed, and passages from the documentation they were already reading. No account, click or customer data is sent to it, and neither the question nor the answer is stored. It is on our public pages only — there is no session there and nothing signed-in to send. If you would rather not use a US service, do not use the box; every page it sits on is readable without it, and [email protected] reaches a person.
Changes
We will update this page before a new sub-processor starts, not after. If you would like to be told when it changes, write to [email protected] and we will add you to the list of people to notify.