KIST / LEGAL
Sub-processors
[TBD — date on publication]
Grapeworks engages the third parties below to run Kist. Each is bound by data protection obligations no less protective than the ones in our own data processing agreement, and we stay liable to the customer for what they do.
We give thirty days notice before adding or replacing any of them, and a customer can object on data protection grounds.
1. Infrastructure and hosting
| Sub-processor | What it does | Location | Transfer safeguard |
|---|---|---|---|
| Oracle Cloud (Oracle Corporation) | Hosts the application server and the warehouse | United Kingdom [TBD — region confirmation] | UK domestic, no transfer |
| Hetzner Online GmbH | Hosts the production data and processing host | Germany and Finland [TBD — region confirmation] | UK adequacy decision for the EEA |
| Vercel Inc. | Hosts and serves the web front end | United States, EU edge regions [TBD — region confirmation] | UK Addendum to the SCCs |
| Cloudflare, Inc. | Network, DNS, access control in front of our services | United States, global network | UK Addendum to the SCCs |
| GitHub, Inc. (Microsoft) | Source code, deployment pipeline, issue tracking | United States | UK Addendum to the SCCs |
2. Analysis
| Sub-processor | What it does | Location | Transfer safeguard |
|---|---|---|---|
| Anthropic PBC | AI-assisted analysis of aggregated data, producing the narrative in reports | United States | UK Addendum to the SCCs, zero-retention API |
Raw personal data does not go through this, and the reason is structural rather than a matter of practice. Identifiable records are written to a separate restricted store, and the aggregate tables that the analysis layer reads are built to read the analytics store only. The narrative is produced from those aggregate tables.
3. Data sources we connect
These are the platforms Kist reads from. Each appears here because we hold credentials and pull data through our own infrastructure, which makes the vendor a sub-processor of ours for that flow.
| Sub-processor | What it does | Location | Transfer safeguard |
|---|---|---|---|
| Google LLC | Analytics, Search Console, Ads and Tag Manager data via Google’s APIs | United States, EU regions | UK Addendum to the SCCs |
| Microsoft Corporation | Microsoft Clarity behavioural and session data, where the connector is enabled | United States | UK Addendum to the SCCs |
| Meta Platforms, Inc. | Advertising performance data via the Marketing API | United States | UK Addendum to the SCCs |
| DataForSEO LLC | Search ranking and visibility data. No customer personal data is sent to this vendor; queries are domains and keywords | United States | UK Addendum to the SCCs |
| FreeAgent Central Ltd | Accounting and invoice data, where the connector is enabled | United Kingdom | UK domestic, no transfer |
| HighLevel Inc. (GoHighLevel) | CRM and contact data, where the connector is enabled. Also holds Grapeworks’ own record of the customer as a client or prospect, live from day one | United States | UK Addendum to the SCCs |
4. What is not on this list, and why
A customer’s own Google Analytics, Meta or Search Console account is not our sub-processor. Those accounts belong to the customer, or to the customer’s client, under their own terms with that vendor. We read from them using credentials the customer delegates to us.
The distinction is easy to miss and it decides who is answerable for what. Google is on the list above because we engage Google’s APIs through our own infrastructure to move data. The customer’s own Analytics property is not, because the customer put that data there, under the customer’s own contract, before we arrived.
Not in the stack at all. MongoDB does not appear anywhere in the Kist codebase and is not a vendor of ours.
Used by Grapeworks, not by Kist. OpenAI, Sentry and Resend are not on Kist data paths. They are not listed as sub-processors for this product.
5. Under assessment
Two vendors sit on the boundary. Both are disclosed here rather than resolved silently.
[TBD — Doppler — list as supporting vendor, or omit]
Doppler (Doppler Inc.), United States.Our secret store. Holds the credentials that let Kist reach a customer’s platforms; does not hold, receive or process customer personal data itself. Recommendation on file: list it in a separate section headed as a supporting vendor rather than a sub-processor, with the distinction stated. Euan’s call.
[TBD — Slack — list, or confirm no alert can carry a personal identifier]
Slack (Salesforce, Inc.), United States.Carries operational alerts and internal notifications. Not a data path for customer records, but an alert body could in principle carry an identifier if one were logged. Recommendation on file: do not list it, and instead confirm structurally that no alert path can emit a personal identifier. Euan’s call.