Sub-processors
The providers that process personal data on our behalf, what they process, where, and on what transfer basis. Last updated 2026-10-07. Selling institutions with a data processing agreement are told of additions before they take effect and may object under the agreement.
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. since 2026-01 | Application hosting, edge network, serverless functions; opt-in performance analytics | All request traffic (including IP addresses); performance metrics only after consent | EU (Dublin, region dub1); US-headquartered provider | EU-US Data Privacy Framework and Standard Contractual Clauses; region pinned to the EU |
| Supabase Inc. since 2026-01 | PostgreSQL database and object storage | Every stored record and document, encrypted at rest | AWS eu-west-1 (Ireland) | Data at rest stays in the EU; provider DPA with SCCs for support access |
| Upstash Inc. since 2026-03 | Rate-limit counters | Hashed user or IP keys and counters only, no deal data | Region as configured (EU) | Provider DPA with SCCs |
| Google LLC (Gemini API) since 2026-05 | Machine translation of the public site; optional data-room AI question answering and document translation | Public-page UI text; for data rooms that enable the features, document content and questions. Never for portfolios in GCC jurisdictions unless an in-region deployment is configured | United States | EU-US Data Privacy Framework / SCCs; zero-retention API configuration to be confirmed in writing |
| Transactional email provider since 2026-01 | Account, NDA, auction, report and privacy-request email | Recipient address and message content | EU | Provider DPA |
| Wathq (Saudi Ministry of Commerce API) since 2026-08 | Commercial-registry verification of institutions and corporate borrowers | Commercial-registration numbers and registered company names; no consumer data | Kingdom of Saudi Arabia | Public registry under Saudi law; no personal data of individuals is sent |
Public data sources that are not sub-processors
- Eurostat (house price index): Residential price index used to carry property appraisals to a cut-off date. Statistics only; nothing is sent.
- EU consolidated financial sanctions list; OFAC SDN list: Lists imported for counterparty screening. Lists are downloaded; screened names are matched on the platform and never sent out.
Questions about a provider, or a seller objection under the data processing agreement: b@bad.loans. See also the privacy policy and the security and data handling page.