Sub-processors
Surventrics Ltd engages the organisations below to process personal data on behalf of our customers. This list is published under Article 28(2) of the UK GDPR and is incorporated into our Data Processing Agreement.
Survey responses do not leave the UK. They are held in London by Neon. The United Kingdom operates under a European Commission adequacy decision, so an EU customer’s data is processed here without standard contractual clauses. The providers located outside Europe handle authentication, payments, email delivery, and AI analysis of text with identifying information already removed.
Current sub-processors
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| NeonNeon Inc. | PostgreSQL database hosting for all platform data | United Kingdom (London) | None for UK data. EU personal data relies on the European Commission's adequacy decision for the UK, so no standard contractual clauses are required. |
| ClerkClerk Inc. | User authentication, session management, and identity services | United States | UK-US Data Bridge |
| VercelVercel Inc. | Application hosting, serverless function execution, and edge network delivery | Global edge network with EU primary region | Standard Contractual Clauses for non-EU edge nodes; EU primary region for processing |
| CloudflareCloudflare Inc. | Object storage for uploaded files (R2) | European Union | None required — data remains within the EU |
| AI processing providerNamed under NDA on request | Survey quality analysis, response quality review, theme extraction, and insight generation | United States | UK-US Data Bridge and/or Standard Contractual Clauses |
| StripeStripe Inc. | Payment processing, subscription management, and invoice generation | United States (with EU processing available) | UK-US Data Bridge |
| ResendResend Inc. | Transactional and marketing email delivery | United States | Standard Contractual Clauses |
What each one processes
Neon
- Data processed: All platform data including account information, survey configurations, survey responses, and operational metadata
- Retention: As directed by Surventrics; Neon acts strictly as infrastructure provider
- Certifications: SOC 2 Type II
Clerk
- Data processed: Account credentials (email, password hashes), session tokens, login history (timestamps, IP addresses, device information), multi-factor authentication records
- Retention: As configured by Surventrics; session data subject to Clerk's expiry policies
- Certifications: SOC 2 Type II
Vercel
- Data processed: HTTP request and response data, edge logs, serverless function execution data
- Retention: Edge logs retained per Vercel's standard retention policy (typically 30 days)
- Certifications: SOC 2 Type II, ISO 27001
Cloudflare
- Data processed: Files uploaded by survey creators — images, media assets, and survey attachments
- Retention: As directed by Surventrics; Cloudflare acts strictly as infrastructure provider
- Certifications: SOC 2 Type II, ISO 27001, PCI DSS
AI processing provider
- Data processed: Question text and response text. Personally identifiable information is scrubbed before any data is transmitted.
- Retention: Zero retention — data is not stored beyond the duration of the API call
- Certifications: SOC 2 Type II
The specific provider is named to customers under NDA on request. We may change AI provider subject to the notice period below, and every provider we engage is contractually bound to retain neither input nor output.
Stripe
- Data processed: Payment card details, billing addresses, invoice records, transaction history, subscription plan details
- Retention: As required by financial regulation; minimum seven years for transaction records
- Certifications: PCI DSS Level 1, SOC 2 Type II, ISO 27001
Resend
- Data processed: Recipient email addresses, sender details, email content, delivery metadata (open rates, bounce status)
- Retention: Delivery logs retained per Resend's standard retention policy
- Certifications: SOC 2 Type II
Changes to this list
We give at least 30 days’ notice before a new sub-processor begins processing customer data. If you object within that period, write to legal@surventrics.ai and we will work with you to find an alternative, or you may terminate without penalty for the affected service.
Requesting a Data Processing Agreement
Business and Enterprise customers can request a DPA, which incorporates this list by reference. Email legal@surventrics.ai. For questions about how we handle personal data, contact privacy@surventrics.ai.
Controller
Surventrics Ltd, registered in England and Wales no. 17305052
22 The Hill, Blunham, Bedfordshire, MK44 3NG, United Kingdom
Data protection enquiries: dpo@surventrics.ai
Effective 20 June 2026.