Sub-processor register
Every third party Avanti Mind Ltd engages to process personal data under Article 28, what each one does, where it does it, and whether it is live yet.
In force from . Published by Avanti Mind Ltd.
The register in full
What this list is
A sub-processor is a third party we engage to process personal data on our behalf, under Article 28 of the UK GDPR. This page names all of them. We keep it current: a provider is added here before it starts processing anything, and removed when we stop engaging it.
8 providers are on the register, and 6 of them are not processing anything yet. Those are configured in the platform against contracted terms but hold no customer data today. We publish them anyway, because the point of a register is to tell you who could touch your data before it happens rather than after.
Transfers outside the UK
Where a provider processes data outside the UK, the safeguard is named in the table. Providers in the EU rely on the UK’s adequacy decision. Providers in the United States are engaged under the UK International Data Transfer Addendum, which is an Article 46 safeguard. Nothing is transferred on the strength of consent alone.
The register
| Provider | What it does | Where | Transfer safeguard | Status |
|---|---|---|---|---|
| AWS | What it doesProduction hosting and transactional email (SES) | WhereUnited Kingdom (eu-west-2, London) | Transfer safeguardProcessed in the UK, no restricted transfer | StatusActive |
| Stripe | What it doesSubscription billing and payments | WhereIreland (Dublin) | Transfer safeguardUK adequacy (EU), no additional safeguard required | StatusActive (test mode) |
| Anthropic | What it doesAI document classification and nominal-code suggestions | WhereUnited States | Transfer safeguardUK Addendum to the EU SCCs, Art. 46 safeguards | StatusEnterprise terms pending |
| Scaleway | What it doesDevelopment-environment storage | WhereFrance (Paris) | Transfer safeguardUK adequacy (EU), no additional safeguard required | StatusTransitional, development data only |
| Voyage AI | What it doesText embeddings for knowledge-base search | WhereUnited States | Transfer safeguardUK Addendum to the EU SCCs, Art. 46 safeguards | StatusConfigured, not active |
| Cohere | What it doesSearch-result reranking for knowledge-base search | WhereUnited States | Transfer safeguardUK IDTA, Art. 46 safeguards | StatusConfigured, not active |
| OpenAI | What it doesOptional text-embeddings provider for knowledge-base search | WhereUnited States | Transfer safeguardUK IDTA, Art. 46 safeguards | StatusConfigured, not active |
| ComplyAdvantage | What it doesPEP, sanctions and adverse-media screening (AML) | WhereTo be confirmed when contracted | Transfer safeguardTo be confirmed before any data is sent | StatusConfigured, not active |
Changes to this register
We update this page when we engage, replace or terminate a sub-processor, and the date at the top of the page moves with it. If you have a contract with us that requires notice of a change, that notice is given under the contract; this page is the public record, not the notification mechanism.
Questions about a provider
Write to us through the contact page and we will answer. The privacy policy sets out what we collect and why, and the security page sets out the controls and how each is checked.
This is the whole register
Not a summary of it, and not the ones we are comfortable naming. If a provider is not on this list, it is not processing your data.