Subprocessors.

1. What this list is

A subprocessor is a company we use to run Atlas Core that, in doing so, processes data you have put into the platform. The Data Processing Agreement you sign at account opening requires us to name them, and this page is where they are named.

Every one of them is contracted under a data processing agreement of our own, restricted to what they need for the service they provide, and reviewed before we sign and once a year after that. Where data leaves the UK or EEA, it moves under Standard Contractual Clauses or an adequacy decision.

We do not use resellers, offshore support desks or outsourced development shops. Nobody else gets access to your tenant.

2. Akamai Technologies (Linode) - hosting

What they do. Everything the platform runs on: application servers, the databases holding your business records, block storage for uploaded files and photos, load balancing, and the nightly backups.

What they hold. All of it - inventory, orders, customers, staff records, invoices, and the operational metadata that goes with them. This is where your tenant physically lives.

Where. EU data centres. Instances run in Milan by default, with Frankfurt as the alternative; we'll tell you which one your instance is on if you ask. Nothing is replicated outside the EU.

3. Cloudflare - DNS, TLS and traffic filtering

What they do. DNS for every Atlas Core domain, the TLS certificates that encrypt your connection, caching of static assets, filtering of malicious traffic and denial-of-service attempts, and routing for our inbound email addresses.

What they hold. Connection metadata as traffic passes through: IP address, the URL requested, browser and device string, timestamps. They terminate TLS, so requests pass through their edge in the clear before being re-encrypted to our servers.

Where. Their global edge network, closest point of presence to whoever is connecting. Cloudflare is certified under the EU-US Data Privacy Framework and we contract under their standard data processing addendum.

4. Stripe - subscription billing and payments

What they do. Take the monthly subscription charge, store the payment method, produce invoices and receipts, apply VAT, and handle failed-payment retries.

What they hold. Your billing contact, company name and address, VAT number, plan, seat count and invoice history. Card details go from your browser straight to Stripe - they never reach our servers, and we could not show you a full card number if you asked.

Where. Stripe Payments Europe processes EU and UK business. Stripe is a payment institution in its own right and a controller for parts of what it holds; their own privacy terms sit alongside ours.

5. Google - website analytics

What they do. Google Analytics 4 measures visits to our marketing websites: which pages get read, which links get clicked, which country the visit came from.

What they hold. Website visitor data only - IP address (truncated by Google before storage), page URLs, referrer, device and browser type, and the analytics cookies set in your browser.

Where. Google's infrastructure, with transfers covered by the EU-US Data Privacy Framework. This runs on the public marketing site alone. There is no analytics tag inside the Atlas Core platform, and no business record you hold in the platform is ever sent to Google.

6. Changes & contact

We publish an update to this page at least 30 days before a new subprocessor starts handling your data, and email the billing contact on every account at the same time. If a new subprocessor is unacceptable to you, that notice period is yours to cancel in, under section 10 of the terms of service.

Removals we publish when they happen; a shorter list needs no notice.

Questions about anyone on this list: [email protected].