Xylora Studios selects subprocessors based on strict data protection standards, operational resilience, and architectural necessity. Every external vendor processing client data is assessed by our Technology and Operations departments before integration into production workflows.
Evaluation and vetting criteria
When a project requires third-party processing—such as managed cloud hosting, email delivery systems, content delivery networks, or continuous integration tooling—the Technology department conducts an initial technical appraisal. We operate under UK data protection legislation and assess every subprocessor against the following operational criteria:
- Data residency and transfer mechanisms: Priority is given to providers offering UK or European Economic Area (EEA) storage. Where data leaves these jurisdictions, we verify that valid transfer mechanisms, such as UK International Data Transfer Agreements (IDTA) or standard contractual clauses, are fully executed.
- Security posture and certifications: Providers must maintain documented operational security controls. We review industry attestations, such as ISO/IEC 27001 certification, SOC 2 Type II reports, and automated vulnerability management procedures.
- Contractual terms and data handling: Contracts must bind the vendor to process data strictly on our documented instructions, enforce confidentiality on all personnel, and mandate prompt breach notifications.
- Architectural reliability: We assess vendor uptime records, redundancy practices, and incident recovery procedures to ensure they meet the delivery requirements agreed in client scopes.
The selection workflow
The onboarding of any subprocessor follows a fixed procedural sequence:
1. Requirement specification: The delivery team identifies an infrastructure requirement during the scoping or development phase. A technical brief outlining required data types and operational load is passed to the Technology department. 2. Due diligence review: Technology reviews the vendor's technical documentation, terms of service, and security posture. If the vendor handles client personal data, Operations & Client Services reviews the Data Processing Addendum (DPA). 3. Risk sign-off: The Technology lead issues a formal clearance or rejection. Clearance is logged in our centralised vendor registry. 4. Deployment and isolation: The vendor is provisioned using isolated environment credentials under the principle of least privilege. Access keys and production database roles are tightly restricted. 5. Periodic audit: Subprocessors are re-audited annually to review updated terms, changes in ownership, or modifications to hosting regions.
Reviews take place during standard studio working hours, Monday to Thursday, 09:00–17:00 GMT. Bespoke vendor assessments requested for custom project scopes are completed within our typical technical turnaround of 48 hours from receipt of the complete technical specification.
Client specifications and custom infrastructure
Clients commissioning bespoke builds may request specific third-party integrations, hosting environments, or analytics providers. When a client mandates a subprocessor outside our standard stack:
- The client must provide direct access credentials, API keys, or an active enterprise account under their own commercial agreement with that vendor.
- The client remains responsible for executing direct DPAs with vendors they mandate.
- The client must supply documentation confirming data residency settings, administrative access, and any specialized environment parameters.
If a client-requested subprocessor fails our baseline security or technical integrity checks, we document the specific vulnerability and issue an advisory via the Ask Xylo chat on the client portal. If an alternative vendor is required to preserve project security, our team presents standard studio options.
Failure cases and vendor offboarding
Subprocessor relationships can fail or change unexpectedly. We actively manage the following operational scenarios:
- Unilateral terms modifications: If an existing vendor alters their terms to weaken data protection, remove UK/EEA residency options, or claim rights over processed data, we halt integration. The Technology department initiates an architectural transition to an alternate approved provider.
- Security incident or material breach: If a subprocessor discloses a vulnerability or breach, the Technology department isolates the integration immediately. We review affected project environments, document scope of impact, and notify impacted clients via the studio portal.
- Persistent service degradation: Where uptime drops below required operational thresholds, we execute migration plans to pre-vetted alternatives.
Deposits are non-refundable once your production slot is held. Before work begins, sums not yet earned are refunded pro rata; after work begins, completed work and booked time are charged. Defects are fixed free of charge within the acceptance window. The full terms are on the Refund Policy page of the main site.
Subprocessor compliance checklist
Before any external service processes project data, the following criteria must be satisfied:
- [ ] Current Data Processing Addendum (DPA) executed with the vendor.
- [ ] UK or EEA data residency selected and locked in environment settings.
- [ ] Access provisioned using role-based permissions and least privilege.
- [ ] SOC 2 Type II or ISO 27001 documentation verified on file.
- [ ] Subprocessor added to the studio internal asset and vendor register.
- [ ] Documented migration or export path available in case of offboarding.