Featherstone Safety Hub
Subprocessor List
This page lists the third-party subprocessors used by Featherstone Safety Ltd to deliver Featherstone Safety Hub. It is maintained as part of our Data Processing Schedule and UK GDPR compliance.
What is a subprocessor?
A subprocessor is a third-party service provider that Featherstone Safety engages to process Customer Personal Data on behalf of customers, as part of delivering Featherstone Safety Hub. Customers have given general authorisation for use of these subprocessors by accepting the Data Processing Schedule at signup.
If we add or replace a subprocessor that processes Customer Personal Data, we will give at least 30 days’ notice as set out in the Data Processing Schedule (DPS 12).
Current subprocessors
Hosting and edge infrastructure that serves the Featherstone Safety Hub web application
Application code, edge-cached responses, and all server-side request processing, which handles Customer Data in transit. UK and EU edge network; server functions execute in Vercel's Dublin (dub1) region on AWS eu-west-1, the same region as the database.
UK GDPR adequacy decision (EEA) / Standard Contractual Clauses where applicable
Database (PostgreSQL), authentication and real-time services that store all customer data and user records
Customer Data including personal data entered into Featherstone Safety Hub. Hosted on AWS eu-west-1 (Ireland, EU) via Supabase.
EEA region. No international transfer. Data remains within the EEA.
Payment processing that handles subscription billing and card payments
Billing information and payment card data (handled by Stripe; card details not stored by Featherstone Safety). UK and EU operations.
UK GDPR adequacy / SCCs. Stripe is certified PCI DSS Level 1.
Transactional email sent by the platform: team invitations, compliance alert digests, overdue-record notifications and enquiry notifications
Recipient email address, recipient name where included, and the titles of the records referenced in a digest. Message content is transient.
Resend is US-incorporated. The processing region for this account is being confirmed; where processing occurs outside the UK/EEA it is covered by Standard Contractual Clauses and the UK International Data Transfer Addendum in Resend's data processing terms.
Business email used for customer communications and support
Email content and contact details where included in business correspondence. Microsoft EU datacentres.
UK GDPR adequacy decision (EU) / EU Standard Contractual Clauses
Source code hosting, and automated daily database backup run as a scheduled job
A compressed daily backup of the Featherstone Safety Hub database, retained for 30 days and then deleted. Because it is a full database backup it contains Customer Data, including special category data where a customer has recorded it. Source code itself contains no customer data.
Covered by GitHub's Data Protection Agreement and Standard Contractual Clauses
Subprocessor changes
We will give at least 30 days’ prior notice before adding or replacing a subprocessor that processes Customer Personal Data. Notice will be sent to the account holder’s registered email address and published on this page.
Customers who object to a new subprocessor on legitimate data protection grounds may contact us at thomas@featherstonesafetyhub.co.uk within the notice period. If we cannot accommodate the objection, the customer may terminate their subscription without penalty.
Questions
For questions about subprocessors or data processing, contact: thomas@featherstonesafetyhub.co.uk