Subprocessors

• Vercel Inc.

  Application hosting and serverless compute — every page render and server action runs here.

  United States company; compute runs in Frankfurt, Germany (eu-central). Content is served through a global edge network.

• Prisma Data, Inc.

  Managed PostgreSQL database holding all application records, including evidence file content.

  United States company; database storage in Frankfurt, Germany.

• Resend, Inc.

  Transactional email delivery — verification codes, invitations, digests and notifications.

  United States company.

Your grant records — every document, ledger entry and audit event — are stored and processed in Frankfurt, Germany. Both the database and the application servers run there, so your data does not routinely leave the European Economic Area.

Two honest qualifications. First, our providers are US-headquartered companies, so their staff may access systems for support and maintenance. Second, transactional email (verification codes, digests) is delivered by a US provider. Both are lawful transfers under UK GDPR: Vercel is certified under the UK Extension to the EU-US Data Privacy Framework, and Resend's data processing agreement incorporates the EU Standard Contractual Clauses with the UK Addendum. The ICO explains these mechanisms here.

• Companies House and the Charity Commission — public registries we query to verify organisation details. They are independent public bodies, not processors acting for us; the privacy notice explains these checks.
• Fonts and assets — self-hosted and bundled with the application; no third-party font or CDN calls are made from your browser.
• Planned integrations (payments, e-signing, AI document reading) are NOT in use today. Each will appear here, with its provider and data flows, before it processes any customer data.