Sub-processors
Last updated: 2026-05-14
Under UK GDPR Article 28(2) we publish the third-party services that process personal data on behalf of Specvo. Each provider is listed with its role, processing location, and the transfer mechanism used to keep the cross-border flow lawful.
Current list
| Sub-processor | Role | Location | Transfer mechanism | Their policy |
|---|---|---|---|---|
| Supabase Inc. | Auth, Postgres database, object storage | EU (Frankfurt) | Intra-EEA — UK adequacy | link |
| Stripe Payments UK Ltd | Payments + card handling (Stripe Checkout) | UK / EU | Intra-UK / EEA | link |
| Anthropic PBC | Claude LLM — extracts SAP fields from your uploads | United States | UK IDTA / EU SCCs + UK-US Data Bridge (Anthropic DPF-certified) | link |
| Google Cloud (Vertex AI) | Gemini LLM fallback for vision extraction | EU region pinned (europe-west1/2) | Intra-EEA with SCCs | link |
| Vercel Inc. | Frontend hosting (Next.js) | Global edge | UK IDTA / SCCs | link |
| Render Services Inc. | Backend API hosting (FastAPI) | United States | UK IDTA / SCCs | link |
| Functional Software Inc. (Sentry) | Error tracking (no Session Replay — disabled May 2026) | EU (Germany) | Intra-EEA | link |
Change-notification commitment
We will notify active users by email at least 14 days before adding, removing, or replacing a sub-processor. The notice will include the new processor’s role, location, and transfer mechanism. You have the right under UK GDPR Article 28(2) to object — write to support@specvo.com within the notice window and we’ll discuss alternatives or pause the addition for your account.
DPA on request
B2B customers (especially OCDEA firms with multiple assessors) can request a signed Data Processing Agreement covering the standard Art 28 clauses + this sub-processor list. Email support@specvo.com.