Current providers
Overview
This schedule lists providers authorised to process customer personal data on RAMSCloud’s behalf. A provider’s separate controller activities are described in the Privacy notice where relevant.
Provider list
| Provider | Service and purpose | Data | Location | Safeguard | Further information |
|---|---|---|---|---|---|
| Supabase (standard provider: Supabase Pte. Ltd.) | Sign-in, database and file storage | Account details, workspace records, documents and uploaded files | RAMSCloud database region: Ireland (eu-west-1); support and operations can involve other countries, including Singapore and the United States | Published DPA includes EU Standard Contractual Clauses and the UK Addendum; regional hosting does not mean all support processing stays in Ireland | Provider information |
| Vercel Inc. | Application hosting, request processing and delivery; service measurement where enabled | Request/device information and application data handled by hosted functions; analytics/performance events where enabled | Global delivery network, with processing in the United States and other provider operating locations; no UK-only or EU-only processing promise | Published DPA sets out processor obligations and international-transfer terms, including Standard Contractual Clauses and UK provisions | Provider information |
| OpenAI (standard UK customer contracting entity: OpenAI OpCo, LLC) | AI document assistance, product help and staff-reviewed support reply drafting | Submitted questions, work descriptions, selected wording/document context, and relevant support messages, internal notes and selected attachments; a hashed user identifier for safety | International processing, including the United States; no account-specific regional residency arrangement verified | Published DPA includes Standard Contractual Clauses and the UK Addendum. API data is not used for training by default unless opted in. App requests disable response storage; this does not eliminate abuse-monitoring retention or other applicable provider exceptions | Provider information |
| Resend (Plus Five Five, Inc.) | Service email delivery | Recipient email addresses, message content and delivery metadata; only information included in the email, rather than automatic access to all workspace documents | Stored customer data is in the United States; the selected email-sending region does not change the storage location | Published DPA includes Standard Contractual Clauses and the UK Addendum; provider states its DPA applies to every account | Provider information |
Change management
Change notice
We will notify affected customers through an appropriate service notice or email before appointing a new or replacement subprocessor, giving a reasonable opportunity to raise a data-protection objection before the change takes effect.
Objection process
Send a reasoned data-protection objection to support@ramscloud.co.uk promptly after notice and before the intended change. We will consider safeguards or alternatives and seek an agreed outcome before using the new provider for the affected customer data. If the objection cannot be resolved, we will agree how to end or avoid the affected processing, including any applicable service termination and refund arrangements.
Subprocessor contact
List last updated
25 October 2026