Sub-processors
4D Services Limited is the processor for personal data you or your agency submit to AuditCrow. We use the sub-processors listed below to deliver the service. Each is engaged under confidentiality and data-protection terms, and only processes data on our instructions. Where a named vendor engages its own further processors, those are listed separately and remain that vendor's responsibility under their DPA with us.
Advance notice of changes
We will give at least 14 days' notice before adding a new sub-processor that will process your personal data, so you have an opportunity to object under your Data Processing Agreement. That notice also covers a vendor's further processors when they will process your personal data.
Currently in use
| Sub-processor | Purpose | Location | Transfer basis |
|---|---|---|---|
| Supabase | Database, storage & secrets vault | UK (eu-west-2, London) | No transfer (UK storage) |
| Clerk | Authentication & session management | United States | UK Extension to EU-US DPF (self-certified) |
| Anthropic | AI-generated audit content & personas | United States | SCCs (DPF status disputed across sources, so verify directly before relying on it) |
| OpenAI | AI-generated audit content (optional models) | United States | UK Extension to EU-US DPF (verify current listing) |
| Firecrawl | Website crawling for audits | United States | DPA available, not confirmed DPF-listed. IDTA recommended pending confirmation |
| DataForSEO | SEO & keyword data | United States / European Union | Not found on DPF list. IDTA recommended |
| Search Console, Analytics, Business Profile & PageSpeed connectors; first-party Google Tag Manager (GTM-58RDM3X4) on app hosts after cookie consent | United States | UK Extension to EU-US DPF | |
| Microsoft Clarity | Session behaviour analytics | United States | UK Extension to EU-US DPF |
| Klaviyo | Email and SMS flow, campaign and list statistics for online stores, via a read-only key the customer supplies (no profiles or events) | United States | UK Extension to EU-US DPF (verify current listing) |
| PostHog | Product analytics and session replay for the app (not your clients' sites) | European Union | No transfer - EU Cloud |
| Inngest | Background job orchestration | United States | Not found on DPF list. IDTA recommended |
| Vercel | Application hosting | United States | UK Extension to EU-US DPF (confirmed via Vercel's own changelog) |
| Brevo | Transactional & marketing email | European Union (France) | No transfer (EU/EEA) |
| Resend | Waitlist contact storage and signup notification email | United States | UK Extension to EU-US DPF (per Resend's DPA, verify current listing) |
| Stripe | Billing & payment processing | United States | UK Extension to EU-US DPF (self-certified) |
| Tinify | On-demand image compression downloads from the Health heavy-files panel | European Union (Netherlands) | No transfer for EU processing. Confirm DPA before treating as live customer data path |
Further processors of Clerk
Clerk (authentication) may engage the vendors below to process user data on its infrastructure. They are not engaged by 4D Services directly. Clerk notified us of Mailgun and Turbopuffer under section 5.3 of Clerk's DPA; they take effect on 23 September 2026. Clerk remains liable for them. Clerk's current list is in its Trust Center.
| Further processor | Engaged by | Purpose | Location | Transfer basis | Effective |
|---|---|---|---|---|---|
| Mailgun Technologies, Inc. | Clerk | Clerk transactional email and related delivery diagnostics (sign-in, invitations, and similar auth messages) | United States | Covered by Clerk's DPA and DPF certification, and Clerk remains liable | 23 September 2026 |
| Turbopuffer (turbopuffer Inc.) | Clerk | Clerk user-record search (identifiers, names, contact details, account status, and public metadata such as role and tenant membership) | Iowa, United States (Google Cloud gcp-us-central1) | Covered by Clerk's DPA and DPF certification, and Clerk remains liable | 23 September 2026 |
Planned (not yet live)
| Sub-processor | Purpose | Location |
|---|---|---|
| Trustpilot | Review signal ingestion (planned) | European Union |
| VouchedFor | Adviser review signal ingestion (planned, Amplifi) | United Kingdom |
| Companies House | Company data lookup (planned) | United Kingdom |
| Company/brand presence signal (planned) | United States | |
| LinkedIn Ads | Campaign Manager reporting via user OAuth (planned) | United States |
Questions about a specific sub-processor or an international-transfer mechanism? Contact privacy@4dservices.co.uk.