Sub-processor list
Updated 8 July 2026
Sub-processors
| Sub-processor | Purpose | Processing region | Safeguards |
|---|---|---|---|
| Google Cloud — Vertex AI Search (Discovery Engine) | Indexing and search over site content | EU / US (EU region by default for EU clients) | Google Cloud Data Processing Addendum, SCCs / EU-US DPF, ISO 27001 |
| Google Cloud — Gemini | Answer generation from retrieved content | EU / US (EU region by default for EU clients) | Google Cloud Data Processing Addendum, SCCs / EU-US DPF; data not used to train Google's models |
| Google Cloud Storage | Intermediate staging of extracted text for import into the index | Same region as the index | Google Cloud Data Processing Addendum, SCCs / EU-US DPF |
| Google — reCAPTCHA Enterprise | Bot and abuse detection | EU / US | Google Cloud Data Processing Addendum, SCCs / EU-US DPF |
Paddle — Merchant of Record (not a sub-processor)
Paddle processes subscriptions and payments as Merchant of Record. In that role, Paddle itself determines the purposes and means of processing payment data and acts as an independent controller, not as our sub-processor. We list Paddle here for transparency; the processing of payment data is governed by Paddle's own terms and privacy policy. We do not store card details.
Change notification and the right to object
We give clients advance notice of any intended addition or replacement of a sub-processor (by email and/or in the dashboard) before the new sub-processor begins processing. A client may object on reasonable data-protection grounds within a reasonable period from the notice. If an objection cannot be resolved, the client may stop using the service for the affected processing. The current version of this list is always available on this page.
Contact
Questions about sub-processors — via the contact form or the privacy contact set out in the Privacy Policy.