DRAFT — CUSTOMISE WITH LEGAL COUNSEL
This page contains placeholder text. You must replace it with content specific to your business before going live. We recommend consulting a UK data protection solicitor.
Sub-processors
Last updated: 30 June 2026
This site is delivered by Mecha Site on behalf of [YOUR COMPANY NAME]. Mecha Site engages the following sub-processors to operate the platform. Under UK GDPR Art. 28(2), [YOUR COMPANY NAME] retains the right to object to any sub-processor for legitimate reasons.
Current sub-processors
| Name | Purpose | Location | Effective | Link |
|---|---|---|---|---|
| Cloudflare, Inc. | Content delivery network, DDoS protection, and DNS for the Mecha Site platform and the websites we manage. | Global edge network (data residency: UK/EU edges preferred) | 2026-01-01 | website |
| Cloudflare Email Routing (Cloudflare, Inc.) | Receives inbound email at the MechaSite sink subdomain (inbound.mechasite.com) on behalf of opted-in webmail customers, ARC-validates SPF/DKIM/DMARC, and posts the ephemeral RFC 822 bytes to our /api/webhooks/cf-email-inbound endpoint via an HMAC-signed Standard Webhooks request. The bytes are a NEW-MAIL ARRIVAL TRIGGER for the W-P2 IMAP fetch (the source of truth) plus an in-process content cache — Cloudflare does NOT persist the messages (per the Email Routing privacy guarantee: "we don't look into, queue, or store emails at any point"). Active only for mailboxes that have opted into the W-P5 "instant tier" copy-forward. | Global edge network (data residency: UK/EU edges preferred) | 2026-06-29 | website |
| Cloudflare R2 (Cloudflare, Inc.) | Object storage for site assets, generated artefacts, and DSAR export bundles. | EEA-resident buckets (jurisdictional hint enforced) | 2026-01-01 | website |
| GitHub, Inc. (Microsoft) | Source code repositories for client websites (deploy pipeline) and internal Mecha Site code. Engaged via GitHub App. | United States | 2026-02-01 | website |
| Inngest, Inc. | Durable workflow orchestration for deployment pipelines, complaint deadline timers, and async jobs. | United States | 2026-02-15 | website |
| MXRoute (MXroute LLC) | Email hosting for client custom domains (managed website mailboxes). Currently testing on basic 10GB tier. | United States (data centre: Texas) | 2026-03-01 | website |
| Neon, Inc. | Managed PostgreSQL database for the Mecha Site platform (London region) and per-site DBs in deployment pipeline. | United Kingdom (eu-west-2 region) | 2026-01-01 | website |
| Openprovider (Hosting Concepts B.V.) | Domain registration on behalf of customers (DM-P3 BUY cycle). Reseller of the upstream ICANN-accredited registrar — passes customer registrant contact details (name, email, postal address, phone) to the relevant registry (Verisign for .com/.net, Nominet for .uk, EURid for .eu, etc.) at the moment of registration. | Netherlands (Rotterdam; KVK Chamber of Commerce 24277249) | 2026-05-15 | website |
| Render Services, Inc. | Application hosting (PaaS) for the Mecha Site platform and generated client websites. | United States | 2026-01-01 | website |
| Resend, Inc. | Transactional email delivery (welcome, password reset, security alerts, complaint acknowledgements, ops notifications). | United States | 2026-01-01 | website |
| Sentry (Functional Software, Inc.) | Error monitoring and (consent-gated) session replay recordings. | United States | 2026-01-01 | website |
| Statsig, Inc. | Feature flag evaluation and aggregate product analytics. Two-mode init (anonymous stableID on public routes; userID on authenticated routes) per consent. | United States | 2026-01-01 | website |
| Stripe Payments UK Ltd | Subscription billing, payment processing, customer object management, VAT handling. | United Kingdom (Stripe UK entity); fall-back EU/US for payment rails | 2026-01-01 | website |
| Upstash, Inc. | Serverless Redis for rate limiting, ephemeral cache, and Layer 1 edge throttling. | Global edge (EU primary region: eu-west-1) | 2026-01-01 | website |
Get notified of changes
Subscribe with your email to receive notification at least 30 calendar days before any sub-processor is added, modified, or removed. Notifications include a one-click unsubscribe link.
RSS feed
Prefer machine-readable updates? Subscribe to the RSS / Atom feed in your favourite reader.
Right to object
If you (or [YOUR COMPANY NAME]) have a concern about a sub-processor, please contact [YOUR CONTACT EMAIL]. We will work with the controller to resolve concerns or, where necessary, terminate the processor relationship.