Sub-processors
The third parties we use to provide Spanwise, and where they process data.
Last updated: 26 August 2026.
Spanwise Technologies Ltd uses the third parties below to provide the Spanwise screening service. This page is the sub-processor list referred to in our Data Processing Agreement.
If you are a customer, paragraph 6 of your Data Processing Agreement governs how this list changes. In outline:
- Where we choose to add a sub-processor, you get at least 30 days' written notice before it starts processing your data.
- Where a change is forced on us, because one of the providers below changes its own arrangements, we pass that notice on within two working days of receiving it. We cannot give more notice than we are given.
- You may object on reasonable data protection grounds, up to the end of the notice period or, for a forced change, at any time before it takes effect. If we cannot resolve your objection and cannot run the service without that sub-processor, you may end the agreement and we refund the fees for the unexpired period.
- One exception, and we would rather you read it here than find it in the contract. If a provider fails or withdraws, or we have to move to deal with a security incident, we may bring in a replacement immediately and without notice. We tell you as soon as we can, and your objection rights then apply as normal.
What every customer should know first
Documents leave the United Kingdom on every screening. All of our sub-processors are established in the United States, and we do not offer UK-only or Europe-only processing.
Images of pages are sent, not only text. Handwritten and scanned calculations cannot be read any other way. Personal data printed on such a page, for example a site address, a practice name or a signature, cannot be removed before the image is sent, because our redaction works on extracted text and an image is the page itself.
The AI providers below are contractually prohibited from using your data to train or improve their models. Separately from that prohibition, their own published practice is to hold data briefly for abuse monitoring, typically for no more than 30 days. Zero-retention processing is not in place, and we do not claim it is.
The hosting and email providers do not run models on your data at all. Hosting holds everything the service stores, for as long as your agreement lasts, not for 30 days.
Every provider below has its own sub-processors. We cannot list those here and keep the list accurate; each provider publishes its own.
Our full assessment of these transfers is available to customers on request. It is honest about what is still being verified.
The list
| Provider | What it does for us | Where it processes | Transfer safeguard |
|---|---|---|---|
| OpenAI OpCo, LLC | The screening itself. Receives the full text of a submitted document and images of individual pages | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum, under OpenAI's data processing addendum |
| Google LLC | Reads images of pages that cannot be read as text, which means scans and handwriting, and scans the extracted text to find the personal data we then remove from retained copies | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum, under Google's Cloud Data Processing Addendum |
| Anthropic PBC | Pulls structured details such as member sizes out of the text for the report, and re-reads a page where the transcription step fails. It also powers the help chat on our website, which is our own activity and not processing of your documents | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum, under Anthropic's commercial terms and data processing addendum |
| Railway Corp. | Hosts the application and the database, so everything the service stores is held there | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum, under Railway's data processing addendum |
| Resend (Plus Five Five, Inc.) | Delivers our emails, including screening reports and password resets. A report quotes passages of the document | United States | Standard Contractual Clauses with the UK International Data Transfer Addendum, incorporated into Resend's terms |
About the safeguards column
We are still confirming three things about the column above: the exact contracting entity for each agreement, the module and version of the clauses relied on, and whether any of these providers is certified under the UK Extension to the EU-US Data Privacy Framework. Until that is done the column describes the safeguard by category rather than naming the exact instrument. We will give you the underlying agreements on request, and our transfer assessment says the same thing.
Changes to this list
When this list changes we update this page and email each customer's notice contact, on the timings set out above. Updating this page is one half of how notice is given, so keeping it current is an obligation we owe you, not housekeeping.
Ask us for a dated copy if you want a record of what this list said on the day you signed. We will attach one to your order form.
Getting in touch
Questions about this list, or a request for the underlying agreements or our transfer assessment: help@spanwise.co.uk.