Sub-processors
Last updated: 15 October 2026
Rabblepop is a trading name of Rabblepop Ltd (company no. 17361712). When we build, host and support software for a client, we process personal data on the client's behalf. These are the companies that help us do that. Each client's data processing agreement names the ones its project uses; a project uses only the providers listed against it.
| Sub-processor | What for | Used for | Where the data is processed | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Website hosting, server functions, content delivery, and file storage for website images (Vercel Blob) | Websites we host | Server functions in London; content delivered from Vercel's global network; image storage in the United States (Washington, D.C.) | Standard Contractual Clauses with the UK Addendum, in Vercel's data processing terms |
| Databricks, Inc. (Neon) | Database | Websites we host | London (AWS eu-west-2) | Data held in the UK. Any access from the United States: UK Extension to the EU–US Data Privacy Framework, otherwise Standard Contractual Clauses with the UK Addendum |
| Plus Five Five, Inc. (Resend) | Transactional and notification email, including sign-in links | Websites we host and platforms that send email | United States | UK Extension to the EU–US Data Privacy Framework, otherwise Standard Contractual Clauses with the UK Addendum |
| Functional Software, Inc. (Sentry) | Error monitoring | All platforms | European Union (Germany) | Data held in the EU, which the UK recognises as adequate. Any access from the United States: UK Extension to the EU–US Data Privacy Framework, otherwise Standard Contractual Clauses with the UK Addendum |
Changes to this list
We give each client at least 30 days' notice before we add or replace a sub-processor that its project uses. We update this page with the change and the date it takes effect, and we email the client's contact for notices under its agreement.
A client may object on reasonable data protection grounds, in writing and giving reasons, before the change takes effect. While an objection made in time is being resolved we will not use the new sub-processor for that client's data where we can reasonably avoid it; the client's data processing agreement says what happens if it cannot be resolved.
If a sub-processor has to be replaced at shorter notice to keep a service secure or running, we will tell the affected clients as soon as we can, and the right to object applies from then.
Where a client's signed agreement gives a different notice period or method, that agreement applies to that client.
Questions about this list: zeki@rabblepop.com