Sub-processors
Last updated: 6 October 2026
These companies process personal data for Staff Checklist on our behalf. Each is bound by data protection terms that are no less protective than our Data Processing Addendum. Where data leaves the UK or the EU, we use the safeguards described in section 10 of the Data Processing Addendum.
| Company | What it does for Staff Checklist | Where |
|---|---|---|
| Cloudflare, Inc. | Runs the app and website (Workers), database (D1), file storage for photos, videos, voice notes and PDFs (R2), background jobs (Queues), email forwarding, DNS and bot checks on sign-in (Turnstile) | Global network; company in the United States |
| Resend | Sends emails: sign-in codes, invitations, alerts, digests and reports | Sends from the EU (Ireland); company in the United States |
| DeepL SE | Translates checklist text and notes when a user asks (DeepL Pro API; texts are not kept after translation) | Germany |
| Deepgram, Inc. | Turns voice notes into text | United States |
| Anthropic, PBC | AI drafting of checklists and tasks when a user asks | United States |
| PostHog Inc. | Product analytics and error tracking, hosted in PostHog's EU cloud | EU (Germany) |
| Stripe | Payments and invoices. For payment data Stripe is also an independent controller | United States and EU |
| Google LLC (Google Workspace) | Hosts our support and privacy email inbox, under Google's Cloud Data Processing Addendum | United States |
Push notifications are delivered, encrypted, by the push service of the device's browser maker (Apple, Google, Mozilla or Microsoft).
Changes. We update this page and email account owners at least 30 days before we add or replace a sub-processor. Business owners can object as described in section 5 of the Data Processing Addendum.
Questions: privacy@staffchecklist.com