Sub-processors
Every third party that processes customer personal data on our behalf, what they do, what data reaches them, and where. This is the page we update when the list changes.
Current sub-processors
A sub-processor is a third party that processes customer personal data on our behalf. The bar for appearing here is that customer data reaches them, not that we pay them: a tool we point at our own servers is not a sub-processor, and a storage provider holding backup archives of customer databases is.
| Sub-processor | What they do | What reaches them | Where | Optional |
|---|---|---|---|---|
| Stripe · Stripe Payments Europe, Ltd. and Stripe, Inc. | Card payment processing, subscriptions and invoicing. | Name, email address, billing address and card details. Card numbers are captured by Stripe directly and never reach G7Cloud systems. | Ireland and the United States | No, required to run the service |
| Cloudflare · Cloudflare, Inc. | Offsite backup storage (Cloudflare R2), and the security and DNS layer in front of the G7Cloud dashboard and API. | Backup archives of customer sites and databases, which may contain any personal data held in them. Request metadata such as IP address and user agent for the dashboard and API. | United Kingdom and the EEA | No, required to run the service |
| Anthropic · Anthropic PBC | Powers the AI Website Builder and the dashboard assistant. Used only when a user in your account chooses to use one of those features. | The prompt the user submits and the site content or account context needed to answer it. Nothing is sent unless a user actively uses the feature. | United States | Yes, can be switched off |
Transfer mechanisms, where processing happens outside the United Kingdom, are set out in Annex III of the DPA. In every case the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies.
The one you can decline
Anthropic is the only sub-processor that can be removed while you keep using G7Cloud, because the AI features it powers are used only when someone chooses to use them.
Nothing reaches Anthropic in the background. No part of the platform sends your site content, files, databases, email or visitor data to an AI provider for our own purposes or on a schedule of ours. Content leaves only when a user in your account uses the AI Website Builder or the dashboard assistant, and only what is needed to answer that request.
On an Enterprise agreement we will disable AI features at account level, after which no user in your organisation can invoke them and Anthropic processes nothing for you at all. Ask at privacy@g7cloud.com.
Deliberately not on this list
Two things a reviewer might expect to see, and why they are absent.
- MaxMind GeoLite2 provides the databases used to identify the country and network of a request. They are downloaded and queried entirely on our own servers, so no visitor data is ever sent to MaxMind.
- Certificate authorities receive domain names during certificate issuance. A domain name is not customer personal data, so this is a transparency note rather than a processing relationship.
We run no third-party analytics, no advertising technology and no data enrichment services, so none appear here. Our own infrastructure, including the mail platform, uptime monitoring and the security layer in front of your site, is operated by us rather than subcontracted.
How changes are notified
We give at least 30 days' notice before a new sub-processor begins processing customer personal data. Notice is given by updating this page and emailing the address on your account.
To be added to the notification list, or to raise an objection to a proposed sub-processor, email privacy@g7cloud.com. Your right to object, and what happens if we cannot resolve it, is in clause 5 of the DPA.