1. What a sub-processor is
A sub-processor is a third-party company that processes personal data on our behalf so that CANOPY can work — hosting the database, sending an email, taking a payment. Each one is bound by a Data Processing Agreement and may only use the data for the purpose listed below.
We do not sell your data, and no company on this list is permitted to use it for their own purposes.
2. Current sub-processors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account and business data | EU (Ireland) |
| Stripe | Subscription billing | Name, email, payment details | EU / US |
| Netlify | Website hosting | Server logs, IP address | EU primary |
| Resend | Transactional email | Name, email address | EU |
| GoDaddy | Domain and email forwarding | Email content in transit | US |
| Sentry | Crash and error monitoring | Device type, app version, error traces | EU residency |
| Anthropic (Claude API) | AI tax tips and business insights | Anonymised financial summaries only — no client names | US |
| Apple | iOS app distribution | Account identifier for App Store delivery | US / Global |
| Android app distribution | Account identifier for Play Store delivery | US / Global |
3. Transfers outside the UK and EEA
Where a provider operates outside the European Economic Area — Anthropic, GoDaddy, Apple and Google — transfers are covered by Standard Contractual Clauses approved by the UK Information Commissioner’s Office, together with the provider’s own supplementary safeguards.
4. Changes to this list
5. Data Processing Agreements
Each provider above operates under its published Data Processing Agreement. If you need copies for your own compliance records — for example if you handle data on behalf of a commercial client — email support@thecanopyapp.com and we will supply the current versions.
6. Contact
Questions about any provider on this list: support@thecanopyapp.com.