Legal
Subprocessors
Last updated: 15 May 2026
This page lists the third-party subprocessors Clerkfolio uses to deliver the service. All subprocessors are engaged under written data processing agreements with obligations equivalent to those in our Data Processing Agreement.
Stay informed
To be notified of changes to this subprocessor list (at least 30 days in advance of any addition or replacement), email subprocessor-changes@clerkfolio.co.uk with the subject line “Subscribe to subprocessor changes”. See our DPA for your rights to object to new subprocessors.
Supabase
European Union / United Kingdom (eu-west-2, London)
Postgres database, user authentication, row-level security, file storage, and Edge Functions. All application data and evidence files are stored in the eu-west-2 (London) region.
Stripe
Ireland (EU) / United States
Subscription management, payment processing, billing portal, customer and subscription records, refunds, and payment disputes. Card data is handled entirely by Stripe and is not stored by Clerkfolio.
Transfer mechanism: EU Standard Contractual Clauses; UK IDTA
Resend
United States
Transactional email delivery for account verification, security notifications, student email verification, and support/feedback routing.
Transfer mechanism: EU-US Data Privacy Framework; UK Extension to the DPF
Vercel
United States (production deployments served from lhr1, London)
Application hosting, deployment infrastructure, and serverless compute. Vercel Analytics (aggregate, anonymised page-view data) is only enabled with user consent. Production edge traffic is served from the London region (lhr1).
Transfer mechanism: EU-US Data Privacy Framework; Standard Contractual Clauses; UK IDTA
Upstash
European Union (eu-west-1 region)
Serverless Redis used for rate limiting on public API endpoints. Stores only transient rate-limit counters keyed by hashed identifiers; no personal portfolio data is stored.
Contact
Questions about this list or our data processing practices should be sent to admin@clerkfolio.co.uk. See also our Privacy policy and Data processing agreement.