SurveyorSuite — Sub-processor List
Last updated: 2026-05-07 Firm: SurveyorSuite Ltd Canonical source: This document. The Terms of Service, Privacy Policy and Data Processing Agreement reference this list rather than reproducing it inline.
About this list
This list is the canonical record of sub-processors of Customer Content under UK GDPR Article 28 — that is, third parties we engage to process the personal data that the Customer (the surveyor or surveyor firm) uploads to the Service about their own clients.
The Customer is the data controller for that Customer Content. SurveyorSuite Ltd is the processor. The providers listed below are sub-processors. Each is engaged under written data-protection terms.
This list is provided to help Customers satisfy their own UK GDPR Article 28 obligations and the RICS Professional Standard §4.1 supplier due-diligence duty.
Notification of changes
We will give Customers 30 days advance notice by email of any addition or material change to this list, except in urgent security situations where shorter notice is permitted by contract.
Current sub-processors of Customer Content
| Provider | Purpose | Region | Terms |
|---|---|---|---|
| Anthropic, Inc. | AI report drafting (optional feature) | USA | Commercial Terms |
| Supabase Inc. | Application data | EU | DPA |
| Cloudflare, Inc. | Storage and content delivery | Global (EU-first) | DPA |
| Vercel Inc. | Application hosting | USA / EU | DPA |
The categories of personal data processed by each provider are limited to what is necessary to deliver the relevant function and are summarised in the Privacy Policy §4–§5. Customers conducting their own DPIA may request the detailed data-flow description from [email protected].
This list covers sub-processors of Customer Content. We separately engage operational vendors to run our SaaS — payment processing, transactional email and similar service functions — which are disclosed in the Privacy Policy. Those vendors do not process the personal data you upload about your clients.
What this does NOT include
- On-device speech-to-text on the iOS and Android apps — runs on the user's own device, no audio leaves the device
- Web Speech API voice dictation in browsers — the browser sends audio directly to its vendor (Google for Chrome; Microsoft for Edge; Apple for Safari) under that vendor's own privacy policy. SurveyorSuite never receives the audio; only the transcript text returned to the page.
Customer rights in respect of sub-processors
Under the Data Processing Agreement, Customers may:
- Request the current sub-processor list (this document, always public)
- Object to a specific sub-processor for legitimate data-protection reasons; we will work in good faith to find a solution or allow termination with a pro-rata refund (DPA §6.4 + ToS §6.3)
- Request the relevant transfer mechanism (UK IDTA or EU SCCs with UK Addendum) for any sub-processor located outside the UK or EEA
- Request the full data-flow description (per-provider categories of data processed, retention periods, retention purpose) by emailing [email protected]
This sub-processor list is a public document. Last updated 2026-05-07.
This list is the canonical reference. Our Terms of Service, Privacy Policy and DPA point to this document rather than reproducing the list inline. Changes are notified to active customers by email at least 30 days in advance.