Sub-processors | Standard Tonnage

1. Purpose

This page is the authoritative, publicly maintained list of third-party sub-processors engaged by Standard Tonnage Limited to deliver the Standard Tonnage service. It forms Annex III of our Data Processing Agreement.

2. Our commitment on sub-processor changes

Before engaging a new sub-processor, or replacing an existing one, in a way that affects the processing of customer personal data, we will:

Perform a security and privacy assessment proportionate to the risk.
Ensure an appropriate Data Processing Agreement is in place.
Confirm a valid international transfer mechanism (if applicable).
Update this page.
Give customers at least 30 days' advance notice by email to the account owner and by updating this page.

Customers wishing to subscribe to email notifications of changes should contact info@standardtonnage.co.uk.

3. Current sub-processors

Sub-processor	Service	Data categories	Location	Transfer mechanism
Supabase, Inc.	Managed PostgreSQL database, authentication, and file storage	Account data, shipping and container data, authentication events, support records	United Kingdom (eu-west-2, London)	No international transfer (UK primary region)
Vercel, Inc.	Application hosting, edge network, deployment, web analytics	HTTP request metadata, deployment logs, aggregated page-view counts	United States, with global edge presence	UK International Data Transfer Agreement; EU-US Data Privacy Framework (Vercel is self-certified)
Anthropic, PBC	Claude API — booking email parsing and alert text generation	Booking and shipment data submitted as prompts (no customer data used for model training)	United States	UK Addendum to EU Standard Contractual Clauses under the Anthropic Data Processing Addendum
Twilio Inc.	SMS and WhatsApp alert delivery	Mobile telephone numbers, alert message content	United States and Ireland	UK Addendum to EU Standard Contractual Clauses under the Twilio DPA
Stripe Payments UK, Ltd.	Payment processing, subscription management, billing	Billing contact details, transaction metadata (card data is held by Stripe, not by Standard Tonnage)	United Kingdom (Stripe UK), with Stripe, Inc. as controller in the United States for certain processing	UK adequacy (Stripe UK) and Standard Contractual Clauses for Stripe, Inc.
Google LLC (Google Workspace)	Business email, calendar, document storage for Standard Tonnage staff	Customer and prospect correspondence, internal documents	United States, with EU data regions available	EU-US Data Privacy Framework and UK Extension
GitHub, Inc. (Microsoft)	Source code hosting, CI, dependency and secret scanning	Source code, build logs, authentication metadata for Standard Tonnage staff	United States and Ireland	EU-US Data Privacy Framework and UK Extension
Carrier tracking APIs	Container event data retrieval (Maersk, CMA CGM, Hapag-Lloyd, MSC and similar)	Container reference numbers, booking references, vessel and port events	Various (each carrier operates globally)	Contract with each carrier under their published API terms; no personal data of the customer's staff is transmitted

4. What we do not use

We do not sell customer data. We do not share customer data with third parties for their own marketing purposes. We do not use consumer-grade AI services (for example, public ChatGPT) to process customer data. We do not engage sub-processors to process customer data outside the list above without following the change-notice process in section 2.

5. Customer objections

If, following a change notice, a customer reasonably objects to a new sub-processor on grounds relating to data protection, we will work with the customer in good faith to find a resolution. Where no resolution is possible, the customer may terminate the affected subscription without penalty.

6. Version history

21 April 2026: Initial publication.