KIST / LEGAL
Sub-processors
Last updated 26 September 2026
Grapeworks engages the third parties below to run Kist. Each is bound by data protection obligations no less protective than the ones in our own data processing agreement, and we stay liable to the customer for what they do.
We give thirty days notice before adding or replacing any of them, and a customer can object on data protection grounds.
1. Infrastructure and hosting
| Sub-processor | What it does | Location | Transfer safeguard |
|---|---|---|---|
| Oracle Cloud (Oracle Corporation) | Hosts the application server and the warehouse | United Kingdom | UK domestic, no transfer |
| Hetzner Online GmbH | Hosts the production data and processing host | Germany and Finland | UK adequacy decision for the EEA |
| Vercel Inc. | Hosts and serves the web front end | Static assets cached in the EU, builds run in the United States | UK Addendum to the SCCs |
| Cloudflare, Inc. | Network, DNS, access control in front of our services | United States, global network | UK Addendum to the SCCs |
| GitHub, Inc. (Microsoft) | Source code, deployment pipeline, issue tracking | United States | UK Addendum to the SCCs |
2. Analysis
| Sub-processor | What it does | Location | Transfer safeguard |
|---|---|---|---|
| Anthropic PBC | AI-assisted analysis of aggregated data, producing the narrative in reports | United States | UK Addendum to the SCCs, zero-retention API |
Raw personal data does not go through this, and the reason is structural rather than a matter of practice. Identifiable records are written to a separate restricted store, and the aggregate tables that the analysis layer reads are built to read the analytics store only. The narrative is produced from those aggregate tables.
3. Data sources we connect
These are the platforms Kist reads from. Each appears here because we hold credentials and pull data through our own infrastructure, which makes the vendor a sub-processor of ours for that flow.
| Sub-processor | What it does | Location | Transfer safeguard |
|---|---|---|---|
| Google LLC | Analytics, Search Console, Ads and Tag Manager data via Google’s APIs | United States, EU regions | UK Addendum to the SCCs |
| Microsoft Corporation | Microsoft Clarity behavioural and session data, where the connector is enabled | United States | UK Addendum to the SCCs |
| Meta Platforms, Inc. | Advertising performance data via the Marketing API | United States | UK Addendum to the SCCs |
| DataForSEO LLC | Search ranking and visibility data. No customer personal data is sent to this vendor; queries are domains and keywords | United States | UK Addendum to the SCCs |
| FreeAgent Central Ltd | Accounting and invoice data, where the connector is enabled | United Kingdom | UK domestic, no transfer |
| HighLevel Inc. (GoHighLevel) | CRM and contact data, where the connector is enabled. Also holds Grapeworks’ own record of the customer as a client or prospect, live from day one | United States | UK Addendum to the SCCs |
4. What is not on this list, and why
A customer’s own Google Analytics, Meta or Search Console account is not our sub-processor. Those accounts belong to the customer, or to the customer’s client, under their own terms with that vendor. We read from them using credentials the customer delegates to us.
The distinction is easy to miss and it decides who is answerable for what. Google is on the list above because we engage Google’s APIs through our own infrastructure to move data. The customer’s own Analytics property is not, because the customer put that data there, under the customer’s own contract, before we arrived.
Not in the stack at all. MongoDB does not appear anywhere in the Kist codebase and is not a vendor of ours.
Used by Grapeworks, not by Kist. OpenAI, Sentry and Resend are not on Kist data paths. They are not listed as sub-processors for this product.
5. Supporting vendors
These vendors support how we run Kist. They do not hold or process customer personal data, so they are not sub-processors.
Doppler. Holds the credentials Kist uses to connect to a customer’s platforms. It does not receive or process customer personal data.