Sub-processors
Last updated 23 August 2026
These are the third parties involved in delivering Calder Standard. The list is complete: there is no analytics provider, no advertising network, no customer messaging tool, no error reporting service and no content delivery network beyond the host itself. The application loads no third-party scripts, fonts or stylesheets.
| Provider | Purpose | What it processes | Location |
|---|---|---|---|
| Supabase Privacy notice | Database, authentication, and storage of uploaded evidence files | Account details, firm details, all compliance content and uploaded documents | European Union — Ireland (AWS eu-west-1) |
| Vercel Privacy notice | Application hosting and delivery | Data in transit while requests are served, plus server logs | European Union — Ireland (Dublin, dub1) for all server processing. Edge delivery is global. |
| Anthropic Privacy notice | Assessing published regulatory material for relevance | Public source material only: a regulator’s published headline, a standards body’s news item, a statutory title, and the public regulatory principles. No customer data. | United States |
On the AI provider
Anthropic is listed because we use it, not because it holds your data. It does not. The monitoring layer reads published regulatory sources and asks the model whether a given published item changes what a regulated firm must do. What it is given is the fetched public item and the public regulatory principles.
Your evidence narratives, uploaded documents, cryptographic inventory, firm name and contact details are never included. That boundary is a property of how the software is written, and the code carries an explicit note that widening it would require this page to change first.
On where processing happens
Both storage and processing happen in Ireland. The database is in AWS eu-west-1 and the application's server functions are pinned to Dublin, so a request is handled in the same place the data lives rather than being sent elsewhere and back.
This was not the default. Vercel places functions in the United States unless told otherwise, which it was doing here until the region was pinned. It is recorded because a claim about where data is processed should be one you can check: every response carries anx-vercel-id header naming the region that served it.
Changes
If a sub-processor is added or removed, this page is updated. Where the change is material to how customer data is handled, account holders are told directly.