Legal
Sub-processor List
Last updated: 1 June 2026 · Version 1.2
MeasureDeck Ltd is committed to transparency regarding the third-party services we use to process customer data. This page lists all current sub-processors — organisations that process personal data on our behalf — in accordance with our obligations under UK GDPR Article 28 and our Data Processing Addendum.
We will provide at least 30 days' advance notice of any additions or changes to this list, giving customers the opportunity to object to such changes. Notification of changes is sent to the email address associated with your workspace owner account and is also communicated via the in-app notification system.
To object to a sub-processor change or to request further information about any sub-processor, please contact dpo@measuredeck.com.
Supabase
InfrastructurePurpose
Database hosting and authentication
Location
UK / EU (AWS eu-west-2, London)
Transfer Mechanism
UK IDTA
Data Processed
All customer account data, project data, commercial records, audit logs
Notes
Primary database and authentication provider. All data stored in the UK (AWS eu-west-2).
Stripe
PaymentsPurpose
Payment processing and billing
Location
UK / EU / USA
Transfer Mechanism
UK Adequacy / UK IDTA
Data Processed
Billing name, email, billing address, subscription details. Payment card data held exclusively by Stripe.
Notes
Stripe is certified under multiple security standards including PCI DSS Level 1. MeasureDeck does not store card details.
OpenAI
AI / Machine LearningPurpose
AI processing for the AI Copilot feature
Location
USA
Transfer Mechanism
UK IDTA / SCCs
Data Processed
Prompts and project context data submitted to the AI Copilot. Data is processed in-context and is not used to train OpenAI models under our enterprise agreement.
Notes
Only data explicitly submitted to the AI Copilot is processed by OpenAI. Users can opt out of the AI Copilot entirely. We have a data processing agreement with OpenAI prohibiting training on customer data.
Resend
EmailPurpose
Transactional email delivery
Location
USA
Transfer Mechanism
UK IDTA / SCCs
Data Processed
Recipient email addresses, email content (e.g. account confirmations, billing notices, security alerts)
Notes
Used for system-generated transactional emails only. Marketing emails are managed separately.
Cloudflare
Infrastructure / StoragePurpose
CDN, DDoS protection, DNS, and document storage
Location
EU / USA (R2 storage EU region)
Transfer Mechanism
UK IDTA / SCCs
Data Processed
Document and evidence files uploaded by customers. IP addresses for DDoS and bot protection.
Notes
Document and evidence storage uses Cloudflare R2 with EU-region configuration. Cloudflare edge nodes process IP addresses globally for DDoS protection.
Change Notifications
We will provide at least 30 days' advance notice before adding, replacing, or materially changing a sub-processor. Notification is provided via:
- Email to the workspace Owner email address
- In-app notification banner within the MeasureDeck platform
- Update to this page with version increment
If you wish to object to a sub-processor change, please contact dpo@measuredeck.com within the notice period.
Contractual Safeguards
MeasureDeck has executed Data Processing Agreements with all sub-processors that include:
- Obligations to process data only on MeasureDeck's instructions;
- Confidentiality obligations binding all personnel with access to customer data;
- Security requirements at least as stringent as those in our DPA;
- Obligations to assist MeasureDeck in fulfilling its obligations to customers under UK GDPR;
- Deletion or return of data at termination;
- Audit rights for MeasureDeck.
For international transfers (USA-based sub-processors), we rely on the UK IDTA (International Data Transfer Addendum) incorporating EU Standard Contractual Clauses (Module 2, controller-to-processor) as the appropriate safeguard under Article 46 UK GDPR.