Sub-Processor Register
Last updated: 16 August 2026
This page lists the third-party services (sub-processors) that Obrix uses to process personal data. Under Article 28 of UK GDPR, we are required to maintain this list and notify clients of any changes.
Each sub-processor only processes data on our instructions, under contract, and with appropriate security measures in place.
Supabase
Supabase Inc
- Purpose
- Database hosting, authentication, and data storage for form submissions, lead records, and client account data.
- Data processed
- Names, email addresses, phone numbers, business details, form responses, engagement data.
- Transfer safeguards
- Standard Contractual Clauses (SCCs). SOC 2 Type II certified.
- Privacy policy
- supabase.com/privacy
Resend
Resend Inc
- Purpose
- Transactional email delivery for contact form notifications, website reports, and follow-up communications.
- Data processed
- Email addresses, names, email content, open/click tracking data.
- Transfer safeguards
- Standard Contractual Clauses (SCCs). SOC 2 Type II certified.
- Privacy policy
- resend.com/legal/privacy-policy
Vercel
Vercel Inc
- Purpose
- Website hosting, serverless function execution, and content delivery.
- Data processed
- IP addresses (in server logs, auto-deleted), request data for serverless functions.
- Transfer safeguards
- Standard Contractual Clauses (SCCs). SOC 2 Type II certified.
- Privacy policy
- vercel.com/legal/privacy-policy
Stripe
Stripe Payments Europe Ltd / Stripe Inc
- Purpose
- Payment processing for client subscriptions and one-off payments.
- Data processed
- Client name, email, billing address, payment card details (card data handled entirely by Stripe, never touches our servers).
- Transfer safeguards
- UK Adequacy (Ireland). SCCs for US transfers. PCI DSS Level 1 certified.
- Privacy policy
- stripe.com/gb/privacy
Umami
Umami Software Inc
- Purpose
- Privacy-focused website analytics. No cookies, no personal identifiers collected.
- Data processed
- Anonymised page views, referral sources, device type, country/city (no IP stored, no personal data).
- Transfer safeguards
- No personal data transferred. Cookie-free. GDPR compliant by design.
- Privacy policy
- umami.is/privacy
Meta (Facebook Pixel)
Meta Platforms Ireland Ltd / Meta Platforms Inc
- Purpose
- Advertising measurement and conversion tracking. Only loaded with user consent.
- Data processed
- Browsing activity on our site (pages viewed, button clicks), cookie identifiers (_fbp, _fbc).
- Transfer safeguards
- UK Adequacy (Ireland). SCCs for US transfers. Only activated after explicit cookie consent.
- Privacy policy
- facebook.com/privacy/policy/
Changes to this register
We will update this page whenever we add or remove a sub-processor. If you are a client with a Data Processing Agreement in place, we will notify you by email at least 14 days before any new sub-processor begins processing your data, giving you the opportunity to object.
Questions about our sub-processors? Email ryan@obrix.co.uk