Authorised Sub-processors
Last Updated: 3 September 2026 • Published under UK GDPR Article 28(2)
Under our Data Processing Agreement (DPA), mycasework.org maintains a public register of third-party sub-processors engaged to support platform operations, database hosting, transactional email delivery, and operational telemetry.
All constituent records at rest are stored strictly within the UK (London, europe-west2). Compute processes requests in-memory within the EEA under reciprocal adequacy regulations. Foundation AI models never retain or train on constituent casework.
Current Sub-processor Register
| Sub-processor | Activity / Purpose | Data Residency | Classification |
|---|---|---|---|
| Google Cloud / Firebase Firestore | Constituent database, cases, timelines, and audit trail persistence | London, UK (europe-west2) | Primary Data Storage |
| Google Cloud / Firebase Storage | Case file attachments and constituent uploaded documents | London, UK (europe-west2) | Primary File Storage |
| Google Cloud / Firebase App Hosting | Web application compute and server-side rendering (SSR) | Netherlands / EEA (europe-west4) | Platform Constraint (Stateless In-Memory) |
| Google Cloud / Cloud Functions (2nd Gen) | Server-side background cron jobs and webhook processors | London, UK (europe-west2) | Primary Serverless Compute |
| Resend Inc. | Inbound and outbound transactional email delivery with Svix signature verification | EU / US (TLS 1.3 in-transit encryption) | Transactional Email Infrastructure |
| Functional Software Inc. (Sentry) | Application error monitoring and performance telemetry | Frankfurt, Germany / EU (de.sentry.io) | EU Operational Cloud (Zero Constituent PII) |
| PostHog Inc. | Product performance analytics and UI usability diagnostics | Frankfurt, Germany / EU (eu.i.posthog.com) | EU Analytics Cloud (Zero Constituent PII) |
| Stripe Payments Europe Ltd. | Recurring subscription billing, payment tokenization, and VAT invoice delivery | Dublin, Ireland / EU (TLS 1.3 encrypted) | PCI-DSS Level 1 Payment Processor (Zero Casework Data) |
Sub-processor Change Notification Policy
Under Section 3 of our Data Processing Agreement, we notify all subscribed Data Controllers at least thirty (30) calendar days in advance of appointing any new sub-processor. Controllers have the statutory right to object to new sub-processors on reasonable data protection grounds.