Sub-processors

Peopl'd uses the following sub-processors to deliver the service. Each is bound by a written data processing agreement and provides appropriate technical and organisational measures to safeguard personal data in line with UK GDPR.

Last updated: 21 May 2026.

Current sub-processors

Sub-processor	Service	Data categories processed	Region	Compliance
Vercel, Inc.	Hosting platform (app + marketing site)	Account data, employee data (in transit and at rest in cache layers)	EU / global edge network	UK GDPR DPA, SOC 2 Type II, ISO 27001
Upstash, Inc.	Encrypted KV database (primary storage for account and tenant data)	Account data, employee data, application state	London (eu-west-2)	UK GDPR DPA, SOC 2, encryption at rest
Resend, Inc.	Transactional email delivery (sign-in links, account communications)	Email addresses, magic-link tokens, email content	EU (eu-west-1)	UK GDPR DPA
Anthropic, PBC	AI processing for document generation	Document inputs (processed, not retained; not used for model training per commercial terms)	United States	UK Standard Contractual Clauses (SCCs) under the UK addendum; commercial terms prohibit training on customer data
Stripe, Inc.	Payment processing (paid subscriptions only)	Payment method details, billing information	US / EU	UK GDPR DPA, PCI-DSS Level 1
Vercel Blob (Vercel, Inc.)	File storage for customer-uploaded files (logos, brand assets)	Customer-uploaded files, file metadata	EU	Covered under the Vercel DPA above
Namecheap, Inc.	Domain registration and DNS management (peopld.com)	None — no personal data passes through this service. Listed for transparency only.	US	Not a data processor for the purposes of UK GDPR; listed for completeness.

International transfers

Most processing happens inside the UK or EU. The two exceptions are Anthropic and Stripe, both US-based. For both, Peopl'd relies on the UK Standard Contractual Clauses (SCCs) under the UK addendum.

Anthropic does not store or train on customer data, per its commercial terms.

How we notify you of changes

Material changes to this list (new sub-processor, change of region, expansion of scope) are notified to all customers by email at least 30 days before taking effect.
Customers may object during the 30-day notice period. Where an objection cannot be resolved, customers may terminate their subscription without penalty.
Minor changes (e.g. a sub-processor's internal reorganisation that does not affect data handling) are reflected here without prior notice.

Data Processing Agreement (DPA)

A full DPA covering Peopl'd's processing of personal data on your behalf, including the role of these sub-processors, is available on request from hello@peopld.com.

Contact

Questions about this register: hello@peopld.com

Peopl'd Limited · Company number 17212665 · Registered in England & Wales