| Name | Service role | Country/Region of processing | Transfer basis if outside the UK | Summary of controls |
| Google Cloud Platform — Google Cloud EMEA Limited | Hosting/infrastructure | United Kingdom — London region; limited support and approved subprocessor processing may occur in other locations | Google Cloud data-processing terms, including applicable Standard Contractual Clauses and UK transfer provisions where required | Encryption in transit and at rest; identity and access controls; least-privilege permissions; logging and monitoring; UK-resident primary hosting |
| Microsoft 365 — Microsoft Ireland Operations Limited | Business email, Microsoft Teams, document collaboration and service administration | United Kingdom for core Microsoft 365 data at rest; other Microsoft and approved subprocessor locations may be used for support, security and service operation | Microsoft Products and Services Data Protection Addendum, including applicable Standard Contractual Clauses and UK transfer provisions | Encryption in transit and at rest; multifactor authentication; access controls; audit logging; security monitoring; retention and deletion controls |
| Mailjet — Mailjet SAS | Transactional and service email delivery | Germany and Belgium for core customer-data storage; other Sinch and approved subprocessor locations may be used for support and service delivery | UK adequacy regulations for relevant EEA processing; Sinch Data Processing Agreement, Standard Contractual Clauses and UK Addendum where required | Encryption; restricted access; security monitoring; resilient EU hosting; contractual subprocessor controls |
| Jitsi as a Service — 8×8, Inc. | Video consultations | United Kingdom, Germany, United States, Brazil, India, Australia and Japan; approved subprocessor locations may also apply | 8×8 Global Data Processing Addendum, including Standard Contractual Clause Module 3 and the UK Addendum for restricted transfers | Encrypted signalling and media; access and session controls; ephemeral meeting rooms; security monitoring |
| ClickUp — Mango Technologies, Inc. dba ClickUp | Implementation management, customer support, issue management and operational workflows | United States, Ireland, Australia or Singapore for core workspace data; Germany and other approved locations may be used for supporting infrastructure and service operation | ClickUp Data Protection Addendum, including Standard Contractual Clause Module 3 and the UK Addendum for restricted transfers | Encryption in transit and at rest; role-based access; logging and monitoring; subprocessor controls; retention and deletion controls |
| Nova Workforce | Technical and operational support (B2B) | India — controlled remote access | UK International Data Transfer Agreement in place | Company-managed devices; least-privilege access; strong authentication; activity logging; staff training; confidentiality obligations |
| Nova Qore | Technical and operational support (B2B) | India — controlled remote access | UK International Data Transfer Agreement in place | Company-managed devices; least-privilege access; strong authentication; activity logging; staff training; confidentiality obligations |
| Nova Rise | Technical and operational support (B2B) | India — controlled remote access | UK International Data Transfer Agreement in place | Company-managed devices; least-privilege access; strong authentication; activity logging; staff training; confidentiality obligations; no customer-data processing underway until all applicable notification or approval processes have completed |
