Last updated: November 2026
Sanctum uses the following third-party sub-processors to provide the Service. Each sub-processor is bound by a Data Processing Agreement (or equivalent) and appropriate international transfer safeguards where applicable.
Under our Data Processing Agreement, we will give you at least 30 days' notice by email before adding or replacing any sub-processor. If you have any concerns about a sub-processor, contact [email protected].
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase, Inc. | Database hosting and storage | UK | Data processed in UK region (London, eu-west-2) - no international transfer |
| Fly.io, Inc. | Runs the Sanctum application and API | UK | Processed in London (lhr). US company - any transfer covered as set out in our DPA |
| Cloudflare, Inc. | Web security and traffic routing - encrypted connections end at Cloudflare, so it handles every request in transit | Global | Handled at the network location nearest the user. US company - any transfer covered as set out in our DPA |
| Sentry (Functional Software, Inc.) | Error monitoring - patient data stripped from reports before they are sent | EU | Germany, under UK adequacy for the EEA |
| Amazon Web Services, Inc. | Encryption key management (AWS KMS); encrypted nightly database backups (Amazon S3, London) | UK / EU | Data processed in UK/EU region - no international transfer |
| Amazon Web Services, Inc. (Amazon Bedrock) | AI language model processing (Claude) - pseudonymised message content only | EU | Data processed in AWS EU regions (EU-only inference), under UK adequacy for the EEA |
| Twilio Inc. | SMS delivery for appointment reminders and surveys | United States | UK International Data Transfer Agreement (IDTA) |
| Stripe, Inc. | Payment processing: practitioner subscriptions, and patient payments where a practice enables them | United States | UK IDTA / Standard Contractual Clauses |
| Brevo (Sendinblue SAS) | Transactional email (notifications, approval alerts) | EU (France) | EU Standard Contractual Clauses (incorporated into UK law) |
| Whereby AS | Video consultation room hosting | EU / EEA | UK adequacy decision for EEA - no international transfer agreement required |
| Speechmatics (Cantab Research Ltd) | Post-consultation audio transcription - only where explicit recording consent is given | UK | UK-based processing - no international transfer |
Claude AI (via Amazon Bedrock). Claude, developed by Anthropic, is run for us by Amazon Web Services through Amazon Bedrock in AWS's EU regions only. Patient names and contact details are stripped or pseudonymised by our processing layer before any content reaches the model. Content stays within AWS's EU infrastructure, is not shared with Anthropic, and under AWS's Bedrock terms is not used to train any model. Anthropic is therefore not a sub-processor.
Stripe. Stripe processes payment information for practitioner subscriptions. If a practice turns on patient payments, Stripe also processes the patient's name, email address and card payment for deposits, packages and invoices, through the practice's own Stripe account (Stripe Connect). Stripe stores payment data in the United States.
AWS KMS. Amazon Web Services manages per-practice encryption keys in the UK/EU region (eu-west-2 London). No patient data is transferred to the United States for key management purposes.
Amazon S3 backups. A nightly backup of the database is encrypted (AES-256) by our backup job and stored in Amazon S3 in London (eu-west-2). Backups are write-once: they cannot be altered or deleted for 90 days, then are deleted automatically. Backups are stored only in the UK.
Whereby. Video consultation rooms are hosted by Whereby AS (Norway), with data stored in Ireland (EU/EEA). The UK's adequacy decision for EEA countries applies - no IDTA is required.
Speechmatics. Audio transcription is performed by Speechmatics (Cambridge, UK) and only occurs where a practitioner has obtained explicit recording consent from the patient. All processing remains in the UK.
We record all changes to our sub-processor list below, in compliance with our obligation to give 30 days' advance notice of additions or replacements.