In short. Six providers are used for the hosting our data processing agreement describes: OVHcloud (France) and Hetzner (Germany), for the servers we administer; Scaleway (France), for backups encrypted to two keys we hold, and for form email; Proton (Switzerland), for mailboxes; GitHub, for source control; and Cloudflare, for DNS only. GitHub and Cloudflare are US companies and are named as exceptions, as is Vercel, a US company used only where a practice's schedule keeps its website there. We run no bulk mail sender and no payment service of our own, and we take no card payments. A Microsoft 365 or Google Workspace tenant that a practice keeps, and its CRM, booking and payment systems, are held in the practice's own name and are not our sub-processors. We give 30 days' notice before adding a provider.
1. What this page is
Under UK GDPR Article 28(2), a processor may engage another processor only with the controller's prior written authorisation. This page is that authorisation in published form: by engaging Custodiance, a practice authorises the providers listed below, and the data processing agreement we sign with each practice refers to this page as the canonical list. The standing list applies to every engagement. The per-estate additions are engaged only where a practice's estate needs them, and each practice's engagement letter carries a schedule naming the ones that apply to it.
Each provider is named with its country of incorporation as well as the region where the data sits, because residency is not jurisdiction: a US company can be subject to US law wherever it holds the data. Nothing on this page is aspirational. If a provider is not here, we do not use it.
2. The standing list
The providers used for the hosting described in the data processing agreement. Each practice's schedule names the servers, and the data centres, that hold its environment.
| Provider | Role | Where the data sits | Data | Safeguard |
|---|---|---|---|---|
| OVH Limited (OVHcloud) United Kingdom company; servers in France | Used for the hosting described in the data processing agreement: servers we administer, which hold a practice's website, applications, databases and files where its schedule names OVHcloud. Also the hardware for our business system (quotes, invoices and client records) and, where analytics are in scope, for our own Plausible Community Edition server, which counts pageviews without cookies. | France. Our own systems are in Gravelines; a practice's schedule names the data centre for its environment. | What a practice's environment holds: website and application data, database records and stored files. Our client contact and billing records, kept for the engagement plus six years for accounting. Cookieless pageview counts with no personal profiles and no shared identifiers, kept 24 months. | OVH Limited's data processing agreement, part of the contract. France is in the EU, which the UK's adequacy regulations cover. |
| Hetzner Online GmbH Germany | Used for the hosting described in the data processing agreement: servers we administer, which hold a practice's website, applications, databases and files where its schedule names Hetzner. | Germany. A practice's schedule names the data centre for its environment. | What a practice's environment holds: website and application data, database records, stored files and form submissions. | Hetzner's Article 28 data processing agreement, under which the processing takes place only in the EU and the EEA. A German company in the EU, which the UK's adequacy regulations cover. |
| Scaleway SAS France | Used for the hosting described in the data processing agreement: off-site storage of the encrypted backups of the databases and files we host, and of our business system; and, where a form on a practice's site sends email, the relay that sends it (Scaleway Transactional Email). | Paris, France. | Backup files, encrypted on the server that makes them, to two keys we hold, before upload: Scaleway holds ciphertext only, and the servers that make the backups cannot read them back. For email it relays: the recipient address and the message content. | Scaleway's Article 28 data processing agreement, part of its terms. A French company in the EU, which the UK's adequacy regulations cover. |
| Proton AG Switzerland | Used for the hosting described in the data processing agreement: a practice's mailboxes, which we administer for it. Also our own mailboxes: hello@custodiance.com, where a practice's enquiries and correspondence with us arrive, and billing@ticketwavehq.com, from which quotes and invoices are sent. | Switzerland. | The content of the mailboxes: names, email addresses, and the messages and attachments sent and received. For our own mailboxes, correspondence with the practice and the content of quotes and invoices. | Proton's data processing agreement, part of its terms. Switzerland is recognised under the UK's adequacy regulations, and by the EU, so no further transfer mechanism is needed. |
| GitHub, Inc. United States (a Microsoft company) | Used for the hosting described in the data processing agreement: source control for the code, content and configuration of a practice's website and applications, from which they are deployed. | United States. | Code, content and configuration, and their deployment history. Personal data only where it appears in content the practice publishes, such as staff names and profiles. Never the personal data in a practice's databases, files or mailboxes, and never credentials. | GitHub's data protection agreement; GitHub is certified under the UK Extension to the EU-US Data Privacy Framework. Named as a US-incorporated exception by design: published content is public on the website in any case, and the private configuration carries no client, patient or pupil data. |
| Cloudflare, Inc. United States | Used for the hosting described in the data processing agreement: DNS only, for domains whose name records we host there, with the records unproxied. No website traffic and no email passes through Cloudflare. | A global network of name servers. | DNS lookups: the name asked for and the address of the resolver asking. | Cloudflare's data processing addendum: transfers rely on Cloudflare's certification under the UK Extension to the EU-US Data Privacy Framework, and on the EU Standard Contractual Clauses with the UK Addendum in the same addendum if that certification lapses. Named as a US-incorporated exception kept by design. |
2a. Per-estate additions
Engaged only in the circumstances stated, and named in the practice's schedule before they handle any of its data.
| Provider | When engaged | Where the data sits | Data | Safeguard |
|---|---|---|---|---|
| Vercel Inc. United States | Where a practice's schedule keeps its website on Vercel rather than on the servers above: hosting and delivery of the website, the server-side code and the request logs. | Server-side code pinned to Vercel's London region (lhr1) in each project's configuration and checked on each deployment. Pages are delivered through Vercel's network from the point nearest the visitor. Vercel's data processing addendum states that its primary processing facilities are in the United States. | Page requests: IP address, browser user agent, the URL asked for and the time, in request logs kept for up to 30 days. Nothing a visitor types into a form is stored by Vercel. | Vercel's data processing addendum, which forms part of its terms, with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Named as a US-incorporated exception: a US company can be subject to US law wherever the data is held. |
| MailerLite (UAB MailerLite) Lithuania | Where the practice's estate includes a newsletter that we send on its behalf, with double opt-in. | Not confirmed: MailerLite is a Lithuanian company, and its data processing agreement does not commit it to a storage region. | Subscriber email addresses, the sign-up source and send metadata. | MailerLite's data processing agreement. An EU-established company; any transfer outside the UK or EU under its Standard Contractual Clauses and the UK Addendum. |
2b. Systems held in the practice's own name
These are not our sub-processors. Each is opened in the practice's own name, under the practice's own contract with its provider, so it processes data for the practice, not for us. We connect each to the estate and, where the engagement includes it, administer it on the practice's behalf under the data processing agreement; a Microsoft 365 or Google Workspace tenant is the exception, which we connect to the estate but do not administer.
- A Microsoft 365 or Google Workspace tenant, where the practice keeps one instead of the mailboxes we provide. Both providers are US companies; where the tenant's data sits is set by its region and edition, which we record in the practice's engagement letter rather than assume.
- A CRM, a booking system or a payment provider, where the estate includes one: chosen with the practice for UK or EU residency, held in the practice's name, and named in its schedule. We take no card payments and run no payment service.
- An e-signature platform, where the practice needs one on its website.
We do not run a bulk mail sender of our own. Where an estate needs one, it is scoped with the practice and added to this page or to the practice's schedule before it handles any data.
3. International transfers
The servers we administer are in France and Germany (OVHcloud and Hetzner), and the backups and the form-email relay are in France (Scaleway). The EU is covered by the UK's adequacy regulations, so no further safeguard is needed for those providers. Switzerland, where Proton holds mailboxes, is covered in the same way.
Three providers are US-incorporated: GitHub, Cloudflare and, where a practice's schedule keeps its website there, Vercel. For each, the safeguard for any transfer outside the UK and EU is in the provider's own terms, as the tables above set out: the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or the provider's certification under the UK Extension to the EU-US Data Privacy Framework. We name them as exceptions rather than leave them out, because a US company can be subject to US law wherever the data sits.
4. Notification of changes
Before we add a provider that will process a practice's personal data, we give the practice at least 30 days' written notice by email to the address on file, naming the provider, its role, where the data will sit, the data concerned and the safeguard. The practice may object on reasonable data-protection grounds within that window; if we cannot accommodate the objection, the practice may end the engagement and we refund any fees prepaid for the period after it ends.
Anyone may ask to be told of changes to this list without being a client: email hello@custodiance.com with the subject "Sub-processor changes".
5. Verification
Each provider's data processing terms form part of our contract with it. On request we will provide a practice with the provider's current terms and with the published security certifications the provider holds, and we will complete a supplier questionnaire within 30 days, as the data processing agreement (section 12) sets out. Our own status, including what we do not hold, is stated plainly in section 6 of that agreement.
6. Related documents
Data processing agreement · Privacy notice · The Custodiance Standard
7. Changelog
- v2.0, 16 October 2026: rewritten for the hosting described in data processing agreement v2.0. OVHcloud and Hetzner are listed for the servers we administer for a practice's website, applications, databases and files, so Hetzner moves from the per-estate additions to the standing list; Scaleway for backups encrypted to two keys we hold; Proton for practices' mailboxes as well as our own. Vercel moves to the per-estate additions, used only where a practice's schedule keeps its website there. The safeguards for GitHub, Cloudflare and Vercel are restated from each provider's own terms, read on 16 October 2026.
- v1.0, 15 October 2026: first publication. Six standing providers (Vercel, GitHub, Cloudflare, Proton, OVHcloud, Scaleway) and two per-estate additions (Hetzner, MailerLite), checked against the vendor register and the code on 15 October 2026.