Trust

Sub-processors

Last updated: 3 May 2026 · Version 1.2

This page lists the third-party services BuiltByGo Ltd uses to deliver our work — the “sub-processors” who may handle personal data on our clients' behalf in the course of providing our services.

We publish this register publicly because we think transparency is the right default. The contractual version of this list lives in Schedule 3 of our Data Processing Agreement; this page is the canonical reference between contract updates.

If you're evaluating BuiltByGo for an institutional engagement, this is what your procurement or risk team will want to see.

What “sub-processor” means

Under UK GDPR, a sub-processor is any third party that processes personal data on behalf of a data processor (us) on behalf of a data controller (the client). In practice: anywhere client data flows through a third-party service we use to deliver work, that service is a sub-processor.

We treat this question conservatively. If a service could see real user data, we list it.

For services that don't process personal data (source-control hosts, build pipelines, internal documentation tools), we explain why they're excluded at the bottom of this page.

Active sub-processors

These services are actively used in the delivery of BuiltByGo's services and may process client personal data.

Infrastructure and hosting

Email and communications

Analytics and monitoring

Translation (conditional)

DeepL is enabled only for engagements that opt in to multi-language translation tooling. We use the DeepL API tier with its no-training data-handling commitment — translated text is not used for DeepL model training.

Conditional sub-processors — AI-assisted internal tooling

The following AI tools are listed as conditional sub-processors. They may process data only under our internal AI usage policy, which prohibits production personal data being passed to AI APIs without prior anonymisation. See our AI Usage Policy for the full operational rules.

We list these proactively because we believe modern data-protection practice requires it, even where their use is governed by anonymisation policy.

Excluded — services that are NOT sub-processors

The following services are used by BuiltByGo but are not sub-processors of client personal data, because under our standard internal policies, they do not handle production client personal data.

If client engagement-specific use ever takes any of these outside their standard policy boundary (for example, real production data in test fixtures), that use becomes a sub-processing relationship and is documented in the engagement Statement of Work and disclosed to the client at that point.

How we manage changes

We follow a transparent process for adding, removing, or replacing sub-processors:

1. Notification. We notify clients in writing at least 30 days before adding or replacing any sub-processor that processes their personal data, with sufficient detail to enable assessment of the change.
2. Objection window. Clients may object on reasonable grounds within 14 days of notification. Where an objection is raised, we discuss alternative arrangements in good faith.
3. Termination right. Where no reasonable alternative is available and the client cannot accept the new sub-processor, the affected services may be terminated on written notice without liability.
4. Equivalent obligations. All sub-processors we engage are contractually bound to data protection obligations equivalent to those in our DPA, including security measures, breach notification, and confidentiality.

How we choose sub-processors

We assess every sub-processor against:

• Data protection compliance — UK GDPR, EU GDPR, and other applicable Data Protection Laws as relevant to the data subjects served
• Security posture — published certifications (ISO 27001, SOC 2, HIPAA, etc.), encryption standards, access controls, breach history
• Data residency — region selection that matches data subject geography and regulatory requirements
• Contractual safeguards — DPAs, Standard Contractual Clauses, IDTA, or equivalent transfer mechanisms in place
• Operational maturity — financial stability, support quality, transparency about subprocessing chains

Region selection

Our default for client engagements is the United Kingdom region of our primary database provider (Supabase London / eu-west-2). Alternative regions — EU-West, Latin American regions, or US — are selected per engagement based on:

• Data subject geography — where the people whose data is being processed actually live
• Regulatory requirements — record-keeping rules in the client's industry (FCA, FDA, Latam reinsurance regulators, etc.)
• Performance and latency — proximity of data to the predominant user base
• Cost and scaling — provider tier and feature parity across regions

The chosen region for each engagement is documented in the relevant Statement of Work.

Questions

For data-protection enquiries about sub-processors: privacy@builtbygo.com

For general questions: hello@builtbygo.com

Document history