Section 01
Purpose
Lists the third-party suppliers that may process personal data on our behalf, so providers and commissioners can carry out due diligence. The fuller, current register sits on the Baton Trust Centre.
Section 02
Current suppliers
| Supplier | Purpose | Location / transfer basis |
|---|---|---|
| Supabase | Form and registration data store | EU |
| Netlify | Website hosting and edge delivery | US edge, under approved transfer safeguards |
| Microsoft 365 | Email and scheduling | EU |
| Cloudflare (R2) | Document file storage (DBS, RTW, ID, training) | US — UK IDTA in place; migration to UK/EU provider in progress |
| Brevo (Sendinblue) | Transactional email delivery | EU (France) — UK adequacy |
| Sling | Rota / shift scheduling + carer contact | US — transfer safeguard (IDTA / DPF) |
| Xero | Payroll processing | UK/EU — adequacy |
| Revolut Business | Carer payments / bank data | UK |
| NEST | Pension administration | UK |
| Pipedrive / Signable | CRM and e-signature | UK/EU |
| Care Check | DBS check processing (umbrella body) | UK |
| GoDaddy | Domain / DNS | US — IDTA / DPF |
| AI / model providers | Model routing for Baton features | Model-agnostic. Baton routes each task to a suitable leading provider under governed terms. Some processing may take place outside the UK under approved safeguards. The current named providers are maintained in the Baton Trust Centre register. |
Section 03
Changes
We review this list and update it when a supplier is added or changed.
Published at wearecare.co.uk/policies/subprocessors.
Changelog
- v2.1 — 16 June 2026: supplier list completed to reflect actual processing stack (adds Cloudflare R2, Brevo, Sling, Xero, Revolut, NEST, Pipedrive, Signable, Care Check, GoDaddy); Cloudflare R2 noted as migrating to UK/EU jurisdiction.
- v2.0 — 1 May 2026: initial published list (Supabase, Netlify, Microsoft 365, AI / model providers).