Subprocessor register
UK GDPR Art 28 · Last updated July 2026 · Hypernest Innovations Limited
We use the following subprocessors to operate EnforceIQ Labs. EU/UK hosting is preferred where available. Fleet customers are notified of material changes under the fleet DPA — contact [email protected] to subscribe to change notifications.
Change notification
Material subprocessor additions or replacements are notified to fleet controllers at least 14 days before the change takes effect, unless an urgent security replacement is required. Controllers may object on reasonable data protection grounds during the notice period.
| Provider | Purpose | Data | Region | Tier |
|---|---|---|---|---|
| Vercel | Hosting, CDN, serverless API | IP, request metadata, deployment logs | EU preferred | Critical |
| Neon | PostgreSQL database | All tenant application data | EU (Frankfurt / London) | Critical |
| Clerk | Authentication & org directory | Email, name, Clerk IDs | US/EU per project | Critical |
| Stripe | Billing & subscriptions | Customer ID, payment metadata (no card PAN in EnforceIQ) | EU/US per account | High |
| Resend | Transactional email (opt-in reminders) | Email, notice references in templates | US/EU per account | High |
| Amazon Web Services S3 | Private notice uploads | Photos, PDFs, object metadata | EU (eu-west-2 recommended) | Critical |
| Upstash | Rate limits, cache, webhook idempotency | Org IDs, hashed keys (ephemeral) | EU option | Medium |
Optional providers
| Provider | Purpose | When used |
|---|---|---|
| Sentry | Error monitoring (analytics cookie only) | Only after you accept analytics cookies |
| OpenAI | AI features (opt-in, PII redacted) | Only after you accept analytics cookies |
| Railway | Background workers (OCR, PRA) | Only after you accept analytics cookies |
Data flow summary
User browsers connect to Vercel-hosted EnforceIQ. Authentication flows through Clerk. Application data persists in Neon PostgreSQL with tenant isolation. Notice uploads store in AWS S3 with signed URL access. Billing events flow through Stripe webhooks. Optional email reminders send via Resend when users opt in. Rate limiting and cache use Upstash.
Due diligence
Each subprocessor is assessed for purpose limitation, UK/EU data residency preference, DPA availability, and security certifications where published. Full legal register (DPAs, transfer mechanisms, onboarding checklist) is maintained in the EnforceIQ Labs compliance documentation pack (GDPR-01).