Sub-processors

We do not engage a sub-processor that we have not assessed for security and transfer-mechanism adequacy. Detailed per-vendor assessments — Transfer Risk Assessments under the UK GDPR ‘not materially lower’ standard — are kept on file and available on request to verified controller customers.

• This page is the source of truth — the “Last updated” date at the top changes whenever the list changes.
• Email notifications are sent to subscribers (sign-up form coming Q3 2026 — for now email privacy@mechasite.com with subject “Subscribe to sub-processor updates”).
• RSS feed at /legal/sub-processors/rss.xml (coming Q3 2026 alongside the email opt-in).
• Direct customer emails for material changes (new vendor in a new data category) sent to the registered owner address on each org.

Where a sub-processor is outside the United Kingdom or European Economic Area, we rely on one of the following mechanisms (per row in our internal register):

• UK adequacy decision — for transfers to countries the UK Government has assessed as adequate.
• UK Extension to the EU-US Data Privacy Framework — for certified US recipients listed at dataprivacyframework.gov.
• UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs — when the above are not available.

Each transfer is backed by a Transfer Risk Assessment evaluating the destination-country legal regime against the “not materially lower” standard introduced by DUAA 2025. Assessments are reviewed annually or sooner on relevant change (legal, contractual, or breach event).

Verified controller customers can request:

• The current per-vendor TRA documentation.
• The DPA (or DPA equivalent) we hold with each sub-processor.
• SOC 2 / ISO 27001 attestations where the vendor publishes them.

Email dpo@mechasite.com from the email address on your account. Our DPA governs how we share this information.