Last updated: 23 June 2026
Sub-processors
Rated Counsel Limited, trading as regSpace (“regSpace”), engages the following sub-processors to provide the Service. This list is kept current. We give affected customers at least 30 days’ notice before we onboard a new sub-processor or materially expand the scope of an existing one, so you have time to object. To subscribe to change notices, email hello@regspace.ai.
| Sub-processor | Entity | Purpose | Data | Location |
|---|---|---|---|---|
| Google Cloud Platform | Google Cloud EMEA Limited / Google LLC | Cloud infrastructure: compute and storage (Cloud Run, Cloud Storage), key management (Cloud KMS), messaging and scheduling (Pub/Sub, Cloud Scheduler) | Tenant documents and snapshots; encrypted at rest with per-tenant customer-managed encryption keys (CMEK), enforced at the storage bucket level | europe-west2 (London) |
| Neon | Neon, Inc. (hosted on AWS) | Managed Postgres database holding the register and platform data, with each tenant's business data in its own database schema | All tenant register and platform data; encrypted at rest and in transit (TLS) | AWS eu-west-2 (London) |
| Google Cloud, Vertex AI (Gemini and Claude) | Google Cloud EMEA Limited / Google LLC | AI inference: Gemini for classification and extraction, and Anthropic Claude served through Vertex Model Garden for regulatory-change drafting, policy redlines, and review | Request payloads (prompts plus retrieved source snippets); no training on client data | Claude on Vertex in europe-west1 (EU); Gemini on Vertex's global endpoint |
| Anthropic (Claude) | Anthropic PBC | AI inference for regulatory-change drafting, policy redlines, and review. Claude runs through Vertex Model Garden or the direct Anthropic API depending on the deployment configuration | Request payloads (regulatory text plus policy snippets); no training on client data | US and EU (provider regions) |
| Firebase / Identity Platform | Google Cloud EMEA Limited / Google LLC | Authentication and identity (sign-in, multi-factor) | Account metadata (email, display name, identity provider) | Google global (metadata only) |
| Postmark | Wildbit, LLC (an ActiveCampaign company) | Transactional email (weekly summaries, account notifications) | Recipient email address and message content | US and EU (provider default) |
| Cloudflare | Cloudflare, Inc. | DNS, edge protection, and bot defence (Cloudflare Turnstile on public forms) | Request metadata (IP address, user agent) | Global edge |
| Vercel (marketing and portal hosting) | Vercel, Inc. | Edge hosting for regspace.ai (marketing) and app.regspace.ai (product portal) | Request metadata; static and cached server-rendered pages; no tenant content | Vercel Edge (London and Dublin primary for UK and EU traffic); transferred under SCCs and the UK IDTA where applicable |
| Vercel (Web Analytics and Speed Insights) | Vercel, Inc. | Optional, consent-gated traffic analytics and Core Web Vitals (LCP, TTFB, CLS) on regspace.ai and app.regspace.ai | Anonymous, hashed visitor identifiers (derived from IP plus user agent server-side; no cookies, no personal data, no cross-site tracking) | Vercel US; transferred under SCCs and the UK IDTA where applicable |
| Stripe | Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment processing and subscription billing for self-serve checkout | Billing contact (name, email, company) and subscription metadata; card data stays with Stripe | US and EU (Stripe regions); transferred under SCCs and the UK IDTA where applicable |
| Langfuse (self-hosted) | Operated by regSpace within Google Cloud (no third-party Langfuse service) | Observability for AI processing traces | Metadata, token counts, latencies; payloads hashed | Same region as the tenant |
| GitHub | GitHub, Inc. (a Microsoft company) | Source control and CI/CD. GitHub Actions authenticates to Google Cloud as a CI/CD identity broker via Workload Identity Federation only | No personal data and no tenant content cross this boundary (application source code and build artefacts only) | US (provider regions) |
Bring your own AI key (BYOK)
By default, AI inference runs under regSpace’s own provider accounts (Google Cloud Vertex AI and Anthropic). As a governance accommodation, a tenant can choose to bring its own Anthropic or Google AI key. When a tenant does so, AI inference for that tenant runs under the tenant’s own provider account and data processing agreement, so that tenant’s AI sub-processor is its own account rather than regSpace’s. The tenant’s key is held in Google Secret Manager and used only to make calls on that tenant’s behalf.
Review cadence
Sub-processors are re-assessed at least annually. Where a sub-processor publishes a SOC 2 or equivalent report, we review it; where one is not available, regSpace conducts its own risk assessment and records the outcome in our internal vendor register. regSpace maintains an internal controls library aligned to SOC 2; we do not currently hold a SOC 2 Type 1 or Type 2 attestation, and ISO 27001 is not in scope.