Subprocessors

Status: draft for legal review. Not yet in force.

Last updated: [[LAST_UPDATED_DATE]]

A subprocessor is a third party that processes personal information on our behalf. This page lists the ones actually in use.

We do not list a provider or a country here speculatively. Where a deployment has not been finalised, the entry says so, and the register in docs/SUBPROCESSORS.md records the review status.

The live register, including data categories, contract status and security review dates, is maintained in docs/SUBPROCESSORS.md and mirrored into the Subprocessor table.

Current Provider | Service | Data handled | Location | Status | ---|---|---|---|---| Render | Application hosting and managed PostgreSQL database | All application data | To be confirmed against the deployed region | In use | (SMTP provider) | Transactional email delivery — verification, password reset, notifications | Email address, message content of the notification | Not yet selected for production | Not yet configured | (Payment processor) | Taking the one-off profile activation fee | Amount, currency, payment status, an opaque reference. Never card numbers — those are entered on the processor's own checkout page | Not yet selected | Not yet configured; no fee is currently charged | (Object storage) | Uploaded files: profile photographs, attachments | Uploaded file content | Local disk in current deployment | S3-compatible storage not yet configured |

Not in use

For the avoidance of doubt, SkillSplore currently uses no: third-party analytics provider; advertising network or ad-tech vendor; data broker or data enrichment provider; payment processor — no fee is currently charged, and lesson payments are never processed by SkillSplore at all; identity or background-check verification provider; AI or machine-learning provider that receives user content.

Changes

We will update this page when a provider is added or removed. If you have a question about a specific provider, contact admin@skillsplore.org.