Sub-processors
Last updated August 2026
The third parties that process personal data on behalf of AIPTx customers, the service each provides and the country in which it processes. Maintained under clause 8 of our Data Processing Agreement, which also gives you 30 days' notice of any change and a right to object.
1. About This Register
1.1 A sub-processor is a third party AIPTx engages to Process Personal Data on behalf of a customer. This page is the named register referred to in clause 8.2 of our Data Processing Agreement, clause 6.2 of our Privacy Policy and clause 11.1 of our Security Policy.
1.2 Each sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in our Data Processing Agreement. AIPTx remains fully liable to the customer for each sub-processor's performance.
1.3 Where a sub-processor Processes Personal Data outside the United Kingdom, the transfer is made under the mechanism identified in clause 10 and Annex IV of the Data Processing Agreement.
2. Current Sub-processors
2.1 The following third parties Process Personal Data on behalf of AIPTx customers.
| Sub-processor | Service provided | Processing location | Categories of personal data |
|---|---|---|---|
| Amazon Web ServicesAmazon Web Services, Inc.Privacy notice | Cloud infrastructure and hosting | United States | All categories recorded in Annex I of the DPA, as held by the hosted Services |
| Google Cloud PlatformGoogle LLCPrivacy notice | Cloud infrastructure and hosting | United States | All categories recorded in Annex I of the DPA, as held by the hosted Services |
| RazorpayRazorpay Software Private LimitedPrivacy notice | Payment processing and fraud prevention | India | Billing name, billing address, transaction records, and the technical data Razorpay collects to prevent fraudulent payment |
| MailgunSinch Email (Mailgun Technologies, Inc.)Privacy notice | Transactional email: account verification, password reset and service notices | United States or European Union, depending on the API region configured | Name, email address, and the contents of the message sent |
| SanitySanity ASPrivacy notice | Content management for the public website. Holds no customer assessment data | European Union and United States | Identity and contact data of AIPTx content editors |
2.2 The categories of sub-processor engaged are:
- Cloud infrastructure and hosting
- Payment processing
- Customer support and communications
- Content management for the public website
2.3 Analytics. AIPTx engages no analytics or advertising provider. Our Cookie Policy records an external scan finding no analytics tag, no product analytics library and no advertising pixel on this site, and we set no analytics cookie.
3. Notice and Your Right to Object
3.1 AIPTx gives at least 30 days' written notice before engaging a new sub-processor or replacing an existing one. Notice is given by email to the customer's registered contact. Customers do not need to ask to be told, and do not need to monitor this page.
3.2 A customer may object to a proposed sub-processor on reasonable data protection grounds by written notice within 14 days of our notice. We will discuss the objection in good faith. If it cannot be resolved within 30 days, the customer may terminate the affected Services without penalty and with a pro-rata refund of prepaid fees. This is clause 8.4 of the Data Processing Agreement, and it governs.
3.3 This page is updated when the register changes. Updating it is not a substitute for the notice in clause 3.1.
4. Status of This Register
4.1 This register is published as it stands rather than held back until it is perfect, because three of our documents already told you it existed. It lists every sub-processor AIPTx has identified and is accurate to the best of our knowledge.
4.2 It is not yet warranted complete. Confirmation against the production estate and the signed vendor contracts is outstanding, and two questions in particular remain open: which platform hosts the production deployment, and whether any server-side product analytics tool is in use. Until that confirmation is recorded, treat this register as current rather than exhaustive, and clause 4.3 applies.
4.3 If you are evaluating AIPTx and need a register warranted complete for a vendor security review, write to [email protected] and we will confirm the position for your assessment in writing. We would rather tell you where the boundary of our knowledge sits than let you discover it during an audit.
5. Contact
Questions about this register:
- Data protection: [email protected]
- Legal: [email protected]
Related documents: Data Processing Agreement, Privacy Policy, Security Policy, Cookie Policy.