Sub-processor List
Last updated: 25th August 2025
| Name | Service role | Country/Region of processing | Transfer basis (if outside UK) | Summary of controls |
| Google Cloud Platform (GCP) | Hosting/infrastructure | United Kingdom (region) | Not applicable (UK resident) | Encryption in transit/at rest; access controls; logging/monitoring; UK-resident primary hosting |
| Nova Workforce | Support (B2B) | India (remote access) | UK IDTA in place | Company-managed devices; least-privilege access; strong authentication; activity logging; staff training; confidentiality terms |
| Nova Qore | Support (B2B) | India (remote access) | UK IDTA in place | Company-managed devices; least-privilege access; strong authentication; activity logging; staff training; confidentiality terms |