Sub-processors
Last updated: 9 May 2026
About this list
AcademyOS is operated by FlowEdge AI Ltd (company number 16247733, registered in England and Wales). FlowEdge AI Ltd acts as a data processor on behalf of each academy tenant who uses the platform.
Under Article 28 of the UK GDPR, FlowEdge AI Ltd may engage other organisations (sub-processors) to process personal data on a tenant's behalf, but only under written terms that bind those sub-processors to data-protection obligations no less protective than the Data Processing Agreement (DPA) signed with the tenant.
This page lists every authorised sub-processor at the date shown above. When we add or replace a sub-processor, we give every active tenant at least 30 days' written notice (in-product and by email) before the change takes effect, in accordance with clause 5.2 of the DPA. Tenants may object on reasonable data-protection grounds during that period.
Authorised sub-processors
| Sub-processor | Service provided | Region(s) of processing | Transfer mechanism |
|---|---|---|---|
Supabase, Inc. | Database (Postgres), authentication, file storage, edge functions | EU (Frankfurt) for tenant data; US for control plane | UK-US Data Bridge / SCCs |
Stripe Payments Europe Ltd / Stripe, Inc. Acts as independent controller for cardholder data per Stripe terms. | Payment processing; Stripe Connect for tenant payouts | Ireland (EU); US for some operations | UK adequacy (Ireland); UK-US Data Bridge / SCCs (US) |
Resend, Inc. | Transactional and marketing email delivery | United States | UK-US Data Bridge / SCCs |
Cloudflare, Inc. | CDN, R2 object storage, WAF, edge analytics | Global edge network with UK origin | UK-US Data Bridge / SCCs |
Vercel, Inc. | Hosting and serverless runtime | Global edge; US for build/deploy | UK-US Data Bridge / SCCs |
Anthropic PBC Inputs and outputs not used for model training; commercial customers excluded from training opt-in. Web search tool disabled. Development Partner Program not joined. | Claude API for AI-assisted text drafting (Messages API) | United States | UK-US Data Bridge / SCCs (UK Addendum auto-applied via Commercial Terms) |
Sentry (Functional Software, Inc.) | Application error monitoring with PII scrubbing | United States | UK-US Data Bridge / SCCs |
GitHub, Inc. No production personal data is committed to source control. | Source-code hosting and CI/CD | United States | UK-US Data Bridge / SCCs |
International transfers
Several sub-processors operate from or include processing in the United States. Restricted Transfers from the UK to the US are covered by:
- The UK-US Data Bridge (in force since 12 October 2023) where the recipient organisation is certified under the Data Privacy Framework.
- The UK Addendum to the EU Standard Contractual Clauses (UK Addendum + 2021 SCCs), as a fallback or where the recipient is not certified.
Where Sub-processors operate UK or EU regions for tenant data (e.g. Supabase tenant database in EU-Frankfurt), no Restricted Transfer occurs for that processing.
Notification of changes
Material changes to this list (new sub-processor, replacement, or change of region or transfer mechanism) trigger a 30-day notice to every active tenant in accordance with the DPA. Tenants may subscribe to change notifications by emailing privacy@academyos.co.uk.
Contact
Questions about this list, the DPA, or our data-protection posture: privacy@academyos.co.uk.
FlowEdge AI Ltd · Company number 16247733 · Registered office: 193 Cambridge Street, Aylesbury, Buckinghamshire, HP20 1BQ, United Kingdom · ICO registration C1928116.