Sub-processors
Last updated: 2026-07-02
InspectReady is operated by Crocker Digital Ltd (company no. 17008789). We use a small set of vetted sub-processors to run the service. This page is the canonical, dated list referenced by our Data Processing Agreement (Schedule 3) and our Privacy Policy.
We do not sell care-home data or share it for third-party marketing. The processors below are engaged only to operate the service, under written contracts imposing data-protection obligations substantially equivalent to those we owe you. Application data — your home's policies, audits, and evidence files — is hosted in the UK (Supabase, London, eu-west-2). Some supporting services (billing, email, monitoring) process limited data outside the UK under appropriate safeguards (UK IDTA / UK Addendum to the EU SCCs, or UK/EU adequacy).
Change notice. We give at least 30 days' notice before adding or replacing a sub-processor, by email to your registered billing contact and by updating this page. If you have a reasonable, data-protection-based objection, contact privacy@inspectready.co.uk.
Current sub-processors
| Sub-processor | Legal entity | Purpose | Region | Transfer safeguard |
|---|---|---|---|---|
| Supabase | Supabase Inc. (US) / Supabase Ltd (UK) | Application database, authentication, and private evidence-file storage | UK (London) — eu-west-2 |
UK-hosted; SCCs as fallback |
| Stripe | Stripe Payments Europe, Limited (Dublin) | Payments and subscription billing | EU (Ireland) primary; US for group support | EU/UK adequacy; UK Addendum as fallback |
| Resend | Plus Five Five, Inc. (Resend) (US) | Transactional email delivery (mail.inspectready.co.uk) |
EU + US | UK IDTA / UK Addendum |
| Netlify | Netlify, Inc. (US) | Application hosting and edge functions | US with EU/global edge | UK IDTA / UK Addendum |
| Upstash | Upstash, Inc. (US) | Rate-limiting cache (Redis) — short-TTL abuse-prevention counters; no account or evidence data | EU (Ireland) — eu-west-1 |
UK IDTA / UK Addendum |
| Cloudflare | Cloudflare, Inc. (US) | Turnstile bot challenge on signup, login, and password reset | Global edge | UK IDTA / UK Addendum |
| GoatCounter | Martin Tournoij (NL) | Cookieless website analytics — aggregated, no personal data | EU | Not a Restricted Transfer |
| Sentry | Functional Software, Inc. (US) | Error monitoring (request bodies and PII stripped) | EU (de.sentry.io) |
EU region; SCCs as fallback |
| UptimeRobot | Uptime Robot Service Provider Ltd | Uptime monitoring — pings public health endpoints; no personal data | Global | No personal data processed |
| Microsoft Ireland Operations Limited | Microsoft Ireland Operations Limited | Microsoft 365 support / data-subject-request mailbox (support@, privacy@, security@) |
EU (Ireland) | No Restricted Transfer in ordinary operation |
If you have questions about any sub-processor, email privacy@inspectready.co.uk.