DRAFT — for review by a solicitor. This text has not yet been approved; it is governed by the law of England and Wales. Divvent will publish a final version and ask you to accept it.

Sub-processors

Version 2, in effect from 2026-09-29

How this list is kept

This list is held to the platform’s code: a test fails if the platform reaches a new outside service that is not on it. We give thirty days’ notice of an addition, as the Data Processing Agreement describes.

Services the platform reaches that are not sub-processors, and why: *.myshopify.com — A connector preset of the import desk: the customer’s own account at that service, reached with their own credential from their application. accounts.google.com — A customer application’s single sign-on preset: the customer’s own identity provider, reached from their application. airtable.com — A connector preset of the import desk: the customer’s own account at that service, reached with their own credential from their application. api.airtable.com — A connector preset of the import desk: the customer’s own account at that service, reached with their own credential from their application. api.hubapi.com — A connector preset of the import desk: the customer’s own account at that service, reached with their own credential from their application. api.twilio.com — A customer application’s own integration, reached from their application with their own credential: the customer’s processor, not Divvent’s (DESIGN.md §17 decision 68). api.xero.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). app.hubspot.com — A connector preset of the import desk: the customer’s own account at that service, reached with their own credential from their application. appcenter.intuit.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). cli.github.com — A link in an installation message; never requested. developer.api.intuit.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). developers.cloudflare.com — A documentation link in a message; never requested. hooks.slack.com — A customer application’s Slack integration: the customer’s own workspace and credential. identity.xero.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). invalid.invalid — A reserved name the import desk uses where no source is set; never requested. login.microsoftonline.com — A customer application’s single sign-on preset: the customer’s own identity provider, reached from their application. login.xero.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). mozilla.org — A licence link in generated source; never requested. oauth.platform.intuit.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). oauth2.googleapis.com — A customer application’s own integration, reached from their application with their own credential: the customer’s processor, not Divvent’s (DESIGN.md §17 decision 68). quickbooks.api.intuit.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). raw.githubusercontent.com — Where the public suffix list is fetched from at build time; no personal data. realtime.invalid — A placeholder origin; `.invalid` never resolves. rehearsal.invalid — A placeholder origin; `.invalid` never resolves. resend-status.com — A provider’s public status page the monitor reads; no personal data is sent. sandbox-quickbooks.api.intuit.com — A customer application’s own accounting integration, or the import desk’s connector: the customer’s own ledger, reached from their application with their own credential — the customer’s processor, not Divvent’s (CONNECTED_PROCESSORS; docs/proposals/63-accounting-sync.md). sheets.googleapis.com — A customer application’s own integration, reached from their application with their own credential: the customer’s processor, not Divvent’s (DESIGN.md §17 decision 68). status.stripe.com — A provider’s public status page the monitor reads; no personal data is sent. www.cloudflarestatus.com — A provider’s public status page the monitor reads; no personal data is sent. www.googleapis.com — A customer application’s own integration, reached from their application with their own credential: the customer’s processor, not Divvent’s (DESIGN.md §17 decision 68). www.w3.org — An XML namespace; never requested.

Cloudflare

Entity: Cloudflare, Inc. (and Cloudflare Ltd in the UK).

Purpose: Hosting. Divvent’s own services and every customer application run on Cloudflare Workers; each application’s database (D1), files (R2) and backups are in a Cloudflare account Divvent holds for that customer alone. Also bot protection on sign-up (Turnstile), DNS look-ups for custom domains, and the sign-in perimeter in front of Divvent’s operator console (Access).

Data: Everything a customer application stores, in the hosting account Divvent holds for that customer; account and sign-in data for the Divvent portal.

Location: Where the customer chose when the company was created (see “Data residency”); Cloudflare’s global network serves requests.

Transfer safeguard: UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in Cloudflare’s DPA.

GitHub

Entity: GitHub, Inc..

Purpose: Building and deploying customer applications. Divvent’s build and deploy programs run on servers GitHub provides; with the customer’s agreement, a platform update is rehearsed on a copy of their database made by that program, in memory only.

Data: A customer application’s generated source code and build output; with consent, the rows of a database copy in transit, never written to disk or to a log.

Location: United States.

Transfer safeguard: UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in GitHub’s DPA.

Anthropic

Entity: Anthropic, PBC.

Purpose: The AI provider. A customer’s request for a change, and the description of their application (its structure, never its records), are sent to Anthropic’s models to propose a change for the customer to approve.

Data: The words of a change request and the application’s model. No customer application data: the platform never reads it, and a test holds that nothing of it reaches a prompt.

Location: United States.

Transfer safeguard: UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in Anthropic’s commercial terms.

Resend

Entity: Resend, Inc..

Purpose: Email. Divvent’s own messages (sign-up links, invitations, notices) and, where a customer application sends mail through Divvent, that mail.

Data: Recipient addresses and the message.

Location: United States.

Transfer safeguard: UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in Resend’s DPA.

Stripe

Entity: Stripe Payments Europe, Ltd. (and Stripe, Inc.).

Purpose: Taking payment for Divvent’s plans: card capture, invoices and the billing portal.

Data: The billing contact’s name and address, and payment details, which Divvent never sees.

Location: Ireland and the United States.

Transfer safeguard: UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in Stripe’s DPA.

Providers you connect

These are not Divvent’s sub-processors: you contract with each directly, and your application reaches them with your own account and credential, sending only what its model declares. They are listed so that the whole of where your data can go is on one page, and each is used only where your application declares it and you connect it.

Google (Google LLC). Only where the application declares a `google` integration and the customer connects their own Google account. What reaches it: Calendar events, spreadsheet rows and issued documents, exactly as the application’s `google` integration’s `sends:` names them.

Twilio (Twilio Inc.). Only where the application declares a `twilio` integration and the customer connects their own Twilio account. What reaches it: A recipient’s phone number and the message or WhatsApp template the application’s `twilio` integration sends.

Xero (Xero Limited (and Xero (UK) Ltd)). Only where the application declares a `xero` integration and the customer connects their own Xero organisation. What reaches it: Customers as contacts (the fields `sends:` names: a name, and where declared an address, email, phone and VAT number), issued invoices and credit notes with their lines, payments and refunds.

Intuit (QuickBooks Online) (Intuit Inc. (and Intuit Limited in the UK)). Only where the application declares a `quickbooks` integration and the customer connects their own QuickBooks Online company. What reaches it: Customers as customers (the fields `sends:` names), issued invoices and credit notes with their lines, payments and refunds.