Support/Legal & Policies/Do you use any subprocessors that touch client data?
Legal & Policies

DO YOU USE ANY SUBPROCESSORS THAT TOUCH CLIENT DATA?

341 views
subprocessorsgdprdata

A short, audited list. Updated when it changes. Notified to ongoing clients within 14 days.

Current subprocessor list

ServicePurposeData residency
Google WorkspaceStudio email, calendar, driveEU
1Password BusinessCredential managementEU
GithubCode hostingUS (data processed under EU SCCs)
FigmaDesign collaborationUS (under EU SCCs)
Frame.ioVideo reviewUS (under EU SCCs)
StripeCard paymentsUS/UK
XeroAccountingUK

What is not in the list

  • No CRM holding client communications outside Google
  • No client data passed to any analytics or marketing tool

Updates

We notify ongoing clients of subprocessor changes within 14 days. The full current list is available on request.

Was this helpful?

Tell us honestly. It is read by the people who write these pages.

If this didn't answer your question, ask Xylo.

Back to Legal & Policies

More in Legal & Policies

Why do you operate Monday through Thursday?

The four-day week is a studio policy, not a holiday. Friday covers maintenance, research, and rest.

Read

How do you handle security and client data?

Encrypted at rest and in transit. Project data deleted 12 months post-handoff unless retention is contracted. UK GDPR registered.

Read

Do you sign NDAs?

Yes. We sign your NDA, or you sign our mutual NDA. Either way, we honor it before reviewing any sensitive brief material.

Read