Sub-processors

Last updated: 2026-05-06

Prospera relies on the third-party services listed below to deliver the platform. Each of them is a "sub-processor" under UK GDPR and our Data Processing Agreement. We perform due diligence on each provider, hold a written processing agreement (or rely on their standard terms where adequate), and enforce contractually-required security & transfer safeguards.

Current sub-processors

Provider	What they do for us	Location	Transfer safeguard
Stripe Payments Europe Ltd	Subscription billing, payment processing, customer portal. Holds card data (we never see it).	Ireland (HQ); processing in EU/UK + US	Adequacy (EU/UK), DPF (US), SCCs/UK Addendum
OpenAI, L.L.C.	Large-language-model API for AI summaries, "why-now" rationales, search-criterion parsing. We use API-only endpoints with training opt-out enabled.	United States	UK-US Data Bridge / DPF; SCCs/UK Addendum
Hunter.io (Hunter Web Services SAS)	Email-pattern detection and email-deliverability verification.	France (EU)	UK adequacy decision for the EU
SerpAPI (SerpApi, LLC)	Search-engine result aggregation — we send a query, receive Google's public index snippets.	United States	UK-US Data Bridge / DPF; SCCs/UK Addendum
Companies House (HM Government)	Public Data API — read-only access to UK statutory company register data.	United Kingdom	N/A (UK to UK; data is public-by-statute)
Resend (Resend Inc.) or alternative transactional email provider	Transactional emails (sign-up confirmation, password reset, billing receipts, security alerts).	United States	UK-US Data Bridge / DPF; SCCs/UK Addendum
Hosting infrastructure	Application hosting, database, file storage, backup. Specific provider listed in Compliance pack available on request.	United Kingdom or European Union	UK adequacy / SCCs as applicable
Cloudflare (if used)	CDN / DDoS protection / TLS termination.	Global edge network; primary US	UK-US Data Bridge / DPF; SCCs/UK Addendum
Sentry (if used for error monitoring)	Application-error monitoring — receives stack traces and minimal request metadata. Personal data scrubbing enabled where possible.	United States	UK-US Data Bridge / DPF; SCCs/UK Addendum

Notification of changes

We may add or change sub-processors. When we do, we will update this page and email account holders at least 14 days in advance unless the change is a security-driven emergency. If you have a reasonable, documented objection to a new sub-processor, contact us — we will discuss alternatives or, in the last resort, allow you to terminate without penalty.

How we vet sub-processors

Each provider has its own privacy policy / DPA which we review before onboarding.
We confirm the provider has appropriate transfer safeguards in place for any data leaving the UK / EU.
We minimise the data shared — for example, OpenAI only ever receives the specific text needed for one AI prompt, never our full database.
We require providers to notify us of security incidents that affect our data.

Contact

Questions about sub-processors or transfers: [email protected].