Sub-processors
Last updated: 25 October 2026
This page lists providers used by the public BoxTick™ site and lead administration. We will update it before adding a provider to the platform.
For public website enquiries and staff administration, TPG acts as controller. These uses are separate from processing Client Personal Data on a customer's instructions. A listing below does not authorise that provider to receive Client Personal Data for the platform.
| Provider | What it does | Processing location | Transfer safeguard | Status |
|---|---|---|---|---|
| Replit | Website hosting and PostgreSQL lead database | Europe (EU) is selected for BoxTick's deployment. Replit says published compute, database and Object Storage are colocated in the selected region. Replit, Inc. is based in the USA. | Replit's DPA incorporates the EU Standard Contractual Clauses. Module 2 applies when TPG is controller and Replit is processor. For UK transfers, the DPA provides for the UK Addendum and/or UK IDTA as applicable. Replit identifies the SCCs as its primary transfer mechanism for UK and EU personal data. Project geography Replit DPA Legal framework Hosting and infrastructure Encryption standards Infrastructure security Security teams | In use; EU region confirmed by TPG |
| Google Workspace | Business email mailbox for hello@boxtick.uk | Google's data centres worldwide, including the United States | Google LLC is certified under the EU-U.S. Data Privacy Framework and its UK Extension (the UK-US data bridge). Google's data processing terms also provide for the EU Standard Contractual Clauses and other approved transfer mechanisms. Google Cloud Data Processing Addendum Official DPF register: Google LLC Google Workspace data locations | In use; source links checked |
| Clerk, managed through Replit | Sign-in and session security for named TPG staff using lead administration | Clerk's DPA provides for US transfers and permits processing wherever Clerk or its sub-processors maintain facilities. A UK or EEA-only arrangement has not been verified. | EU-U.S. Data Privacy Framework and UK Extension to the EU-U.S. DPF (the UK-U.S. data bridge). The official register lists Clerk as active for non-HR data. Clerk DPA Clerk GDPR notice Clerk DPF notice Official DPF register | Staff sign-in |
| Resend | Transactional lead notifications and confirmations | United States (data storage and primary processing). Ireland (eu-west-1) is used for email routing and sending only, not storage. | Resend's DPA includes the EU Standard Contractual Clauses, Module 2 for TPG as controller and Resend as processor, and the UK Addendum for UK transfers. Resend also states that it participates in the EU-U.S. Data Privacy Framework and its UK Extension. Resend GDPR and data location Resend DPA Resend sub-processors Signed documents (Resend sign-in required) | Verified and live email delivery tested |
Replit also documents TLS 1.2 or higher for data in transit and AES-256 for data at rest. Its general information security overview describes infrastructure primarily in US Google Cloud Platform data centres, while its project-geography documentation says published project resources are colocated in the selected region. The EU selection confirms the region for BoxTick's published resources. It does not mean every Replit service or support operation is limited to the EU, which is why the DPA transfer safeguards are listed above.
Platform processing: verification outstanding
The platform's UK and EEA-only processing requirement includes remote support access, not just hosting. No provider arrangement has been verified here as meeting that requirement for Client Personal Data. EU hosting, Standard Contractual Clauses or a Data Privacy Framework certification alone do not establish UK and EEA-only processing.
Before Client Personal Data is accepted, TPG must verify the relevant contractual restrictions and configuration for hosting, backups, logs, AI services and support access, including onward providers. The platform provider list must identify each authorised use before that use begins. Resend's current US storage arrangement must not be treated as a UK or EEA-only platform email service.
Please do not send client records, evidence documents or connected-system data through public enquiry forms or to the public contact mailbox.
Not currently used
- Geist and Geist Mono are self-hosted by BoxTick. Google Fonts is not used to deliver fonts.
- No payment provider is used on the public site. Stripe is the selected provider for future platform payments but is not yet in use.
- No AI model provider is used on the public site. A platform AI provider has not been selected.
- No advertising, social or cross-site analytics provider is used.