Legal
Sub-processor register
Last updated: 31 July 2026
This register lists every third party that processes personal data on behalf of our customers, as required by Article 28 of the UK GDPR. It forms part of our Data Processing Addendum. If you are a customer using 99 Data Rooms to share documents, you are the controller of the personal data in those documents, we are your processor, and the companies below are our sub-processors.
Sub-processors of customer data
Each of these can, in the course of doing its job, handle personal data that you control. Where a sub-processor is incorporated outside the United Kingdom, the transfer mechanism column records what makes that lawful.
| Sub-processor | What it does for us | Data it can process | Where it runs | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Core platform: database, authentication, document storage, and server-side application logic. | Documents, account details, recipient email addresses and names, visit analytics. | United Kingdom (London). | Data is resident in the UK. Supabase is US-incorporated, so remote support access is covered by Standard Contractual Clauses with the UK International Data Transfer Addendum. |
| Cloudflare, Inc. | Website and application hosting, web application firewall, and R2 object storage used to serve and back up documents. | Documents held in object storage, plus request metadata such as IP address. | Object storage is pinned to Cloudflare's European Union jurisdiction. Hosting is served from Cloudflare's global edge network. | Standard Contractual Clauses with the UK International Data Transfer Addendum. |
| Amazon Web Services (AWS Lambda) | Converts Word, Excel and PowerPoint files into a PDF so they can be previewed in the browser. | The contents of the specific document being converted, for the duration of the conversion. | Ireland (eu-west-1). | Transfers from the UK to the European Economic Area are permitted under the UK's adequacy regulations. |
| Amazon Web Services (Amazon Bedrock) | Powers the document drafting assistant. Used only when a customer actively asks it to draft or review something. | The text a customer submits to the assistant. | European Union regions only, via an EU-scoped inference profile. | Transfers from the UK to the European Economic Area are permitted under the UK's adequacy regulations. |
| Resend, Inc. | Sends transactional email: share notifications, one-time access codes, signature requests, and account email such as password resets. | Recipient email addresses and names, and the content of the notification itself. | Ireland (eu-west-1). | Sending is in the European Economic Area, and transfers from the UK to the EEA are permitted under the UK's adequacy regulations. Resend is US-incorporated, so remote support access is additionally covered by Standard Contractual Clauses with the UK International Data Transfer Addendum. |
Payments: an independent controller, not a sub-processor
Paddle.com Market Ltd (United Kingdom) is our payment provider and acts as merchant of record, which means it sells the subscription to you on its own account. For payment and tax data Paddle is an independent controller deciding its own purposes, not our sub-processor, so it is recorded here separately rather than in the table above. Paddle never receives your documents or the personal data inside them. Its own privacy terms govern the billing data it holds.
Services that do not touch customer data
For completeness, two services process data for which we are the controller. They are not sub-processors under your DPA because they never handle the personal data you control, and neither of them runs on document viewer pages.
- GoatCounter counts aggregate page views on our public marketing pages only. It sets no cookies and stores nothing on your device. See our cookies and local storage policy.
- Cloudflare Turnstile protects our own sign-in and sign-up forms from automated abuse.
How we tell you about changes
We will give customers at least 30 days' notice before a new sub-processor starts processing customer personal data, or before an existing one is replaced. Notice is given by updating this page, changing the date at the top, and emailing the account owner of every paid workspace. If you have a reasonable objection to a new sub-processor on data protection grounds, tell us within that notice period and we will work with you to find a solution. If we cannot, you may terminate the affected part of the service and we will refund any prepaid fees for the period you no longer use, as set out in the Data Processing Addendum.
The only exception is an urgent replacement: if a sub-processor fails or has to be removed for security reasons, we may act first and tell you immediately afterwards, because leaving the service broken or exposed would be worse for you than the notice period is worth.
Getting a copy on paper
If your procurement process needs this register as a signed document alongside a countersigned DPA, email legal@99developer.com and we will send both.