This page is the current list of subprocessors engaged by Finnovator Ltd, published under paragraph S2.3.1 of Schedule 2 (Data Processing Addendum) to the Finnovator Terms and Conditions of Supply. It forms part of the general authorisation given by customers under that paragraph.
The list reflects the live Google Cloud project used for Finnovator (Cloud Run, Cloud SQL and Memorystore) as of 6 September 2026.
How changes to this list work
Before engaging a new subprocessor, Finnovator will update this page and notify each customer's registered administrator email address at least 30 days in advance.
A customer may object on reasonable data-protection grounds within 10 Business Days of that notice. The parties will then seek a commercially reasonable solution. If none is available, either party may terminate the affected Service and Finnovator will refund prepaid unused Fees. This reflects paragraph S2.3.2 of Schedule 2.
Each subprocessor is bound by written data-protection obligations providing materially equivalent protection to those Finnovator owes its customers. Finnovator remains responsible for its subprocessors' processing to the extent required by Data Protection Laws.
To receive email notification of changes to this page, write to privacy@finnovator.co.uk.
Current subprocessors
| Subprocessor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Infrastructure and hosting | |||
| Google Cloud EMEA Limited (Google Cloud Platform) | Hosting of the Platform: Cloud Run (application services), Cloud SQL (PostgreSQL), Memorystore (Redis), and related logging and backup. Public UIs are served from europe-west1; APIs and the database from europe-west2 (London). | United Kingdom (europe-west1 and europe-west2) | UK / adequacy. Where Google support access originates outside the UK, Google's UK Addendum to the EU standard contractual clauses applies. |
| Artificial intelligence | |||
| Google LLC (Vertex AI / Gemini) | Generation of AI-assisted narrative, commentary and in-product chat responses from customer data submitted for that purpose. Invoked via Google Cloud Vertex AI, not a separate consumer chatbot. | United States (Vertex AI location us-central1) | Google Cloud Data Processing Addendum and UK Addendum to the EU standard contractual clauses. |
| Communications | |||
| Twilio SendGrid, Inc. | Delivery of service, security, billing and notification emails to authorised users (invoice, payment link, credentials, OTP and similar transactional mail). | United States | Twilio Data Protection Addendum and UK Addendum to the EU standard contractual clauses. |
| Calendly LLC | Strategy-call scheduling from the marketing site. Processes the name, email and meeting details a visitor submits when they book. | United States | Calendly DPA and UK Addendum to the EU standard contractual clauses. |
| Know-your-customer | |||
| Firmcheck Ltd | AML / firm background checks initiated during paid-tier onboarding (api.firmcheck.com). | United Kingdom | UK. No international transfer for this processing. |
| Billing operations (Finnovator's own invoices) | |||
| Xero Limited | Creation and PDF storage of Finnovator's sales invoices to customers (platform billing). This is Finnovator's Xero organisation, not the customer's ledger. | New Zealand (Xero's hosted service) | UK adequacy regulations for New Zealand. |
Not subprocessors
The following are not subprocessors of Finnovator and are not covered by this page.
- Accounting platforms a customer chooses to connect — Xero, QuickBooks Online or Sage. Those providers are engaged by the customer under the customer's own contract. Finnovator receives data from them at the customer's direction (read-only OAuth or a file the customer uploads).
- Spreadsheet / Excel uploads the customer provides. Those files are stored on Finnovator's Google Cloud infrastructure (already listed above).
- Stripe Payments UK Ltd / Stripe, Inc. Card payments for Finnovator subscriptions are taken on Stripe Checkout. Stripe acts as an independent controller of cardholder data under Stripe's own terms. Finnovator does not receive or store full card numbers.
- Companies House (Registrar of Companies). Used only to look up publicly available company records when a white-label partner is verified.
- Professional advisers engaged by Finnovator under duties of confidentiality, where they do not process customer data as part of delivering the Services.
- Any provider that receives only Aggregated Data as defined in clause 12.3 of the Terms.
Plaid bank-feed integration exists in code but is not enabled on the live environment (PLAID_STUB). It is not a current subprocessor. We will add it here before it is switched on.
Related documents
- Terms and Conditions of Supply, including Schedule 2 (Data Processing Addendum)
- Privacy Policy
- Cookie Notice
- What Finnovator can and cannot access (accounting scopes)
Contact
Questions about this list, or requests for a copy of the data-protection terms in place with any subprocessor, should be sent to privacy@finnovator.co.uk.