Legal
Sub-processors
Version 1.2 · Last updated 28 August 2026Every third party that processes personal data on our behalf, what it does, where it does it, and the transfer mechanism that applies. This page is referenced by our Data Processing Agreement, which governs how changes to this list are notified.
1. How to read this page
Our products run on different infrastructure. A sub-processor listed against one product does not necessarily process data for another. The SMS Platform and Regulatory AI Intelligence share no hosting, no database and no storage.
Sections 2 to 4 list sub-processors engaged where we act as a processor for customer data. Section 5 lists providers engaged where we act as a controller for website visitor data — those are not sub-processors under Article 28 of the UK and EU GDPR, or Article 19 of the Data Protection (Jersey) Law 2018, and are listed for completeness because people ask.
JLEC Limited is established in Jersey. Jersey and the United Kingdom both benefit from European Commission adequacy decisions, and the United Kingdom treats Jersey as adequate. Transfers between the EEA, the UK and Jersey therefore require no additional transfer mechanism. Transfers to the United States are covered by the EU Standard Contractual Clauses and, for UK personal data, the UK International Data Transfer Agreement or Addendum.
2. SMS Platform
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc.United States (incorporated) | Database hosting and file storage. Holds all SMS Platform customer data, including uploaded documents and attachments. | European Union — Paris, France | EU SCCs (Modules 2 and 3); UK IDTA / Addendum |
| Vercel Inc.United States (incorporated) | Application hosting, content delivery and serverless function execution. Processes data in transit; does not store customer records at rest. | EU edge infrastructure serves UK and EU traffic; company is US-headquartered | EU SCCs (Module 2); UK IDTA / Addendum |
3. Regulatory AI Intelligence
Regulatory AI Intelligence does not run on the SMS Platform's infrastructure. Customer documents, the regulatory corpus and the application database are held on dedicated hosting in the United Kingdom, and model inference is performed by a separate provider in the European Union. Neither Supabase nor Vercel processes Regulatory AI data.
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| OVHcloudOVH Groupe SAS and its group companies | Dedicated server hosting. Holds the application database, the regulation corpus, uploaded customer documents and the document index at rest. | United Kingdom | UK / Jersey adequacy — no additional mechanism required |
| WorkOS, Inc.United States | Authentication and identity. Processes user email addresses and sign-in events to operate magic-link sign-in. | United States | EU SCCs (Module 3); UK IDTA / Addendum |
| Amazon Web ServicesAmazon Web Services EMEA SARL and its group companies | Language model inference via Amazon Bedrock. Processes the text of a question and the passages retrieved to answer it, for the duration of the request. | European Union — see the note below | Intra-EU / UK / Jersey adequacy — no additional mechanism required |
| Backblaze, Inc.United States (incorporated) | Encrypted off-site backup storage. Holds the nightly encrypted backup of the application database, the regulation corpus, uploaded customer documents and persisted memory. Encrypted before it leaves the hosting server; Backblaze cannot read the contents. | European Union — Amsterdam, Netherlands | EU SCCs (Module 3); UK IDTA / Addendum |
Where inference runs today. Model inference is performed through Amazon Bedrock against a European Union geographic inference profile, which keeps each request inside the EU region set. The model developer is not a sub-processor of your data on this route: the data-flow relationship is with Amazon Web Services, and the developer receives no customer data. A customer choosing this product on the basis of where its data is processed is entitled to know where that is today, not where it is intended to be.
No model training. We do not permit any sub-processor to use customer data to train, fine-tune or evaluate machine learning or artificial intelligence models. For occurrence report data this prohibition is absolute and is additionally recorded at clause 10.2.3(c) of our Master Services Agreement.
Self-hosted components. Document conversion and optical character recognition, text embedding, the application database, the cache and the regulatory corpus all run on our own dedicated hosting described in the OVHcloud row above. They are not separate sub-processors and no data is disclosed to a third party by their operation.
4. Both products, and company-wide
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Microsoft Corporation | Transactional and contact-form email delivery via the Microsoft Graph API. Limited to sending mail. | US-headquartered; EU data centre processing available | EU SCCs (Module 3); UK IDTA / Addendum |
| Paddle.com Market LimitedEngland & Wales, no. 08815936 | Payment processing and VAT invoicing, as merchant of record. Holds billing contact and transaction data; we never receive card details. | United Kingdom | No restricted transfer. Paddle's own terms cover any onward US transfer |
5. Website analytics — we act as controller
The providers below process website visitor data on citadelaero.com, where we act as controller. They do not process customer data held in either product, and are not sub-processors under our Data Processing Agreement. Both are loaded only where you have consented to analytics cookies — see our Cookie Policy.
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Google LLC / Google Ireland Limited | Google Analytics 4 — aggregate website usage statistics. | United States; Google Ireland for EEA and UK data | EU SCCs (Module 2); UK IDTA / Addendum |
| Microsoft Corporation | Microsoft Clarity — heatmaps and aggregate session recordings. Sets Microsoft identifiers, including MUID, which are shared across Microsoft properties such as Bing and Microsoft Ads. | United States | EU SCCs (Module 2); UK IDTA / Addendum |
6. Changes to this list
We give customers not less than thirty (30) days' notice before engaging a new sub-processor or replacing an existing one, by email to the customer's notified contact and by updating this page.
A customer may object to a proposed change on reasonable data protection grounds within that period, in writing to privacy@citadelaero.com. We will discuss the objection in good faith. If it cannot be resolved, the customer may terminate the affected Order Form without penalty and receive a pro-rata refund of prepaid fees for the unexpired period.
We may engage a replacement sub-processor without that notice period where necessary to address an urgent security or availability risk, in which case we will notify affected customers as soon as reasonably practicable.
Every sub-processor listed here is engaged under a written contract imposing data protection obligations no less protective than those in our Data Processing Agreement. Copies of the relevant transfer mechanisms are available to customers on written request to privacy@citadelaero.com.
7. Being notified
Customers receive notice of changes automatically at their notified contact address. Anyone else who wishes to be notified may ask to be added to the notification list at privacy@citadelaero.com.
© JLEC Limited t/a CitadelAero · citadelaero.com · Version 1.2