Legal
Sub-processor register
Last updated: 14 September 2026
This register lists every third party that processes personal data on behalf of our customers, as required by Article 28 of the UK GDPR. It forms part of our Data Processing Addendum. If you are a customer using 99 Data Rooms to share documents, you are the controller of the personal data in those documents, we are your processor, and the companies below are our sub-processors.
Sub-processors of customer data
Each of these can, in the course of doing its job, handle personal data that you control. Where a sub-processor is incorporated outside the United Kingdom, the transfer mechanism column records what makes that lawful.
| Sub-processor | What it does for us | Data it can process | Where it runs | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Core platform: database, authentication, document storage, and server-side application logic. | Documents, account details, recipient email addresses and names, visit analytics. | United Kingdom (London). | Data is resident in the UK. Supabase is US-incorporated, so remote support access is covered by Standard Contractual Clauses with the UK International Data Transfer Addendum. |
| Cloudflare, Inc. | Website and application hosting, web application firewall, and R2 object storage used to serve and back up documents. | Documents held in object storage, plus request metadata such as IP address. | Object storage is pinned to Cloudflare's European Union jurisdiction. Hosting is served from Cloudflare's global edge network. | Standard Contractual Clauses with the UK International Data Transfer Addendum. |
| Amazon Web Services (AWS Lambda) | Converts Word, Excel and PowerPoint files into a PDF so they can be previewed in the browser. | The contents of the specific document being converted, for the duration of the conversion. | Ireland (eu-west-1). | Transfers from the UK to the European Economic Area are permitted under the UK's adequacy regulations. |
| Amazon Web Services (Amazon Bedrock) | Powers the document drafting assistant. Used only when a customer actively asks it to draft or review something. | The text a customer submits to the assistant. | European Union regions only, via an EU-scoped inference profile. | Transfers from the UK to the European Economic Area are permitted under the UK's adequacy regulations. |
| Resend, Inc. | Sends transactional email: share notifications, one-time access codes, signature requests, and account email such as password resets. | Recipient email addresses and names, and the content of the notification itself. | Ireland (eu-west-1). | Sending is in the European Economic Area, and transfers from the UK to the EEA are permitted under the UK's adequacy regulations. Resend is US-incorporated, so remote support access is additionally covered by Standard Contractual Clauses with the UK International Data Transfer Addendum. |
Independent controllers, not sub-processors
Two companies decide their own purposes for some of the data they receive from us. They are recorded here separately rather than in the table above, because the Article 28 table is for suppliers acting on our instructions and these two are not.
Payments
Paddle.com Market Ltd (United Kingdom) is our payment provider and acts as merchant of record, which means it sells the subscription to you on its own account. For payment and tax data Paddle is an independent controller deciding its own purposes, not our sub-processor, so it is recorded here separately rather than in the table above. Paddle never receives your documents or the personal data inside them. Its own privacy terms govern the billing data it holds.
Session-replay analytics on our marketing pages
Microsoft Ireland Operations Limited provides Microsoft Clarity, which records how our public marketing pages are used so we can find what is broken or unclear. It runs only where a visitor has agreed, and never on a document somebody shared with you, never inside an account, and never for anyone signed in. Microsoft uses some of what it receives for its own purposes as well, so for this processing it is an independent controller alongside us rather than our sub-processor.
It never receives your documents or the personal data inside them. We do not send it any name, email address or account identifier, and the recording is masked so typed text and document contents are not captured. Our contract is with Microsoft Ireland Operations Limited, so our own transfer is from the UK to the EEA under the UK's adequacy regulations; any onward transfer to Microsoft Corporation is covered by Microsoft's own Standard Contractual Clauses, which is its arrangement rather than a mechanism we assert on its behalf. The cookies it sets, how long it keeps recordings, and a real limitation on erasing one person's data are set out on our cookies page.
Services that do not touch customer data
For completeness, these services process data for which we are the controller. They are not sub-processors under your DPA because they never handle the personal data you control, and none of them runs on document viewer pages.
- GoatCounter counts aggregate page views and simple interaction totals on our public marketing pages only. It sets no cookies and stores nothing on your device. See our cookies and local storage policy.
- Cloudflare Web Analytics counts entry page views and page-load performance on the same public pages. It sets no cookies. It was missing from this list before September 2026, which was an omission rather than a change.
- Cloudflare Turnstile protects our own sign-in and sign-up forms from automated abuse.
- Our own edge log notes, for public pages only, which network a request arrived from. No third party is involved: the record is written by our own code to our own database, which is why it appears here rather than in the register above. It holds no IP address and no identifier. See our cookies and local storage policy.
How we tell you about changes
We will give customers at least 30 days' notice before a new sub-processor starts processing customer personal data, or before an existing one is replaced. Notice is given by updating this page, changing the date at the top, and emailing the account owner of every paid workspace. If you have a reasonable objection to a new sub-processor on data protection grounds, tell us within that notice period and we will work with you to find a solution. If we cannot, you may terminate the affected part of the service and we will refund any prepaid fees for the period you no longer use, as set out in the Data Processing Addendum.
The only exception is an urgent replacement: if a sub-processor fails or has to be removed for security reasons, we may act first and tell you immediately afterwards, because leaving the service broken or exposed would be worse for you than the notice period is worth.
Getting a copy on paper
If your procurement process needs this register as a signed document alongside a countersigned DPA, email legal@99developer.com and we will send both.