Sub-Processors List
Third-party sub-processors used to provide the Safer Recruitment Suite services, including SafeRecord, SafeApply, and SafeVerify.
Note: All sub-processors are bound by written contracts with GDPR-compliant clauses and, where applicable, Data Processing Agreements. International transfer safeguards (International Data Transfer Agreement (IDTA)) are in place where required. TSA maintains oversight of all sub-processors to ensure compliance with UK GDPR and the Data Protection Act 2018.
Current Sub-Processors
| Sub-Processor | Service Provided | Data Location | Purpose |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and infrastructure; authentication (Cognito); document text extraction (Textract); AI inference (Bedrock) | United Kingdom (eu-west-2, London) | Primary hosting, data storage (S3, RDS), and compute; user authentication and session management; assistive document analysis (non-decisioning); secure AI inference for summarization and discrepancy detection (no training on customer data) |
| Google (Gmail API) | Email delivery services | May process outside UK/EEA (under appropriate safeguards) | Transactional and service-related email delivery (email addresses and email content) |
| Paddle.com Market Ltd | Subscription billing and invoicing | United Kingdom (Paddle.com Market Ltd is UK-established); Paddle may process outside the UK/EEA under its own safeguards | Raising and managing invoices on TSA's instructions. TSA sends Paddle the billing contact name and email address, billing address, and any VAT/tax registration number, and retrieves those billing records back; the Paddle customer reference is stored against the TSA account. Card and bank details are entered directly by the Customer into Paddle's checkout and are never received or stored by TSA. |
| Waxley Graham LLC | Software development and platform operation | United States (under appropriate safeguards where personal data is accessed) | Development, maintenance, and operation of the Safer Recruitment Suite platform |
| IONOS Cloud Limited | Email hosting (mailboxes) | United Kingdom or the European Economic Area | Hosting of TSA's email mailboxes, which hold correspondence such as support requests, recruitment and reference correspondence, data subject rights requests and complaints, and billing notifications. Email generated by the Suite itself is delivered through the Gmail API (above); IONOS hosts the mailboxes in which correspondence is received and retained. |
Independent Controllers
The following parties receive personal data in connection with the Suite but are not sub-processors. They determine their own purposes and means for the processing described below, and act as controllers in their own right rather than on TSA's instructions. Their own privacy terms apply to that processing.
| Party | Role | Personal Data Involved | Governing Instrument |
|---|---|---|---|
| Paddle.com Market Ltd | Merchant of record for the sale | Transaction and payment data, billing contact and address details, sales tax and fraud-screening data | Paddle's Data Sharing Addendum (controller-to-controller), incorporated into Paddle's Master Services Agreement, and Paddle's own privacy policy |
Paddle therefore appears in both lists: as a sub-processor for the invoicing TSA instructs it to carry out, and as an independent controller for the merchant-of-record processing it performs for its own purposes (taking payment, calculating and remitting sales tax, fraud screening, and meeting its own financial and regulatory obligations).
Sub-Processor Changes
TSA will provide advance written notice (via email or in-app notification) to Customer administrators of any material changes to this sub-processor list at least 30 days in advance. Customers may object to new sub-processors within 30 days of notice on reasonable data-protection grounds. The process for objections is set out in our Data Processing Agreement.
Sub-Processor Obligations
All sub-processors are required to:
- Process personal data only in accordance with TSA's instructions
- Implement appropriate technical and organizational measures to protect personal data
- Comply with applicable data protection laws, including UK GDPR
- Notify TSA of any personal data breaches without undue delay
- Assist TSA in fulfilling data subject rights requests where applicable
International Transfers
Where sub-processors process data outside the UK/EEA, appropriate safeguards are in place, including:
- International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner's Office
- Adequacy decisions where applicable
For billing and payments, Paddle.com Market Ltd is UK-established. Where Paddle transfers data outside the UK/EEA it does so under its own safeguards: the EU Standard Contractual Clauses together with the UK Approved Addendum issued by the Information Commissioner's Office — Module Two (controller to processor) under Paddle's Data Processing Addendum for the invoicing TSA instructs, and Module One (controller to controller) under Paddle's Data Sharing Addendum for its merchant-of-record processing. Please refer to Paddle's privacy information at checkout.
Contact
This list is maintained under our Data Processing Addendum. For questions about our sub-processors, please contact our Data Protection Officer at dpo@thesafeguardingalliance.org.uk.