Effective date: 3 August 2026
A sub-processor is a third party that processes personal data on our behalf in order to deliver the WayfinderHQ service. The table below lists the sub-processors we currently use, what each one does, and where each one processes data. We keep this page current and it forms part of our Data Processing Agreement, under which subscribing firms give general written authorisation for us to engage the sub-processors listed here.
Before we add a new sub-processor or replace an existing one, we give advance notice by updating this page and, where the change is material, by emailing the account contact for each subscribing firm. That notice gives firms the opportunity to object on reasonable data protection grounds, as described in the sub-processors section of the Data Processing Agreement.
Not every sub-processor is engaged for every firm. Some are used only where a firm turns on the relevant feature, for example identity and AML verification, SMS notifications, or an accounting integration.
| Provider | Purpose and data processed | Location of processing |
|---|---|---|
| Stripe | Payments and subscription billing. Processes the name, email address, billing address and payment card details of the person who subscribes, and the subscription and invoice records for the firm. We do not store full card numbers on our own systems. | United States, United Kingdom and European Economic Area |
| DocuSeal | E-signature. Processes the names, email addresses, signatures and audit trail of signatories, and the contents of engagement letters and agreements signed through the platform. | United States and/or European Economic Area |
| Thirdfort | Identity and anti-money-laundering (AML) verification, where a firm chooses to run a check. Processes identity documents and identity data, date of birth, address data, facial-likeness data used for document and liveness matching, and the verification result including any sanctions, politically exposed person or adverse media match. | United Kingdom and/or European Economic Area |
| Twilio | SMS delivery. Processes mobile telephone numbers and the content of SMS notifications sent through the platform. | United States and/or European Economic Area |
| FreshBooks | Accounting sync, where a firm connects its own FreshBooks account. Processes the accounting, client and billing data synced between FreshBooks and the platform. | Canada and/or United States |
| Supabase | Database, authentication and file storage. Hosts the core application database, manages account login, and stores documents and files uploaded to the platform. This is the primary store for firm data. | United Kingdom (London) |
| Resend | Transactional email. Processes recipient email addresses and message content in order to deliver account, onboarding, client portal and notification emails. | United States and/or European Economic Area |
| Sentry | Error and performance monitoring. Processes technical diagnostic data such as error reports, stack traces, IP address and browser information, which may incidentally include limited personal data present in an error context. | United States and/or European Economic Area |
| Vercel | Application hosting and execution, and cookieless analytics. Our application code runs on Vercel, so personal data is processed in transit and in memory for as long as it takes to serve a request. That includes data submitted through the platform, such as prospect registration, questionnaire and identity and AML verification submissions, and data read from our database and rendered into the pages a user sees. Vercel also processes the technical request data (such as IP address and request metadata) needed to serve the application, and runtime logs, which may incidentally contain limited personal data. Vercel is not the store of record and does not retain application data at rest: that data is held in Supabase. Vercel Analytics measures anonymous page views and site performance; it does not set cookies and does not identify individuals. | United Kingdom (London), for processing only; application data is stored by Supabase, also in the United Kingdom |
Where we have independently confirmed the region in which a provider processes data, the location column names that region. Where a provider operates in more than one region and we have not confirmed which one applies, the column states the range of regions honestly rather than naming a specific data centre. If you need a definitive statement of processing location for a particular provider in order to complete your own transfer risk assessment, please contact us and we will confirm the current position with that provider.
Several of these providers process data outside the United Kingdom. Where they do, we rely on an appropriate transfer mechanism, being an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses. For firms in South Africa, cross-border transfers are addressed in the section 72 provisions of our Data Processing Agreement.
If you would like to be notified whenever this list changes, email us at hello@wayfinderhq.co.uk and ask to be added to the sub-processor change notification list. We will then email you in advance of any addition or replacement, in addition to updating this page.
Objections to a proposed sub-processor should also be sent to hello@wayfinderhq.co.uk.