Sub-processors | Standard Tonnage

1. Purpose

This page is the authoritative, publicly maintained list of third-party sub-processors engaged by Standard Tonnage Limited to deliver the Standard Tonnage service. It forms Annex III of our Data Processing Agreement.

2. Our commitment on sub-processor changes

Before engaging a new sub-processor, or replacing an existing one, in a way that affects the processing of customer personal data, we will:

Perform a security and privacy assessment proportionate to the risk.
Ensure an appropriate Data Processing Agreement is in place.
Confirm a valid international transfer mechanism (if applicable).
Update this page.
Give customers at least 30 days' advance notice by email to the account owner and by updating this page.

Customers wishing to subscribe to email notifications of changes should contact info@standardtonnage.co.uk.

3. Current sub-processors

Entries marked Pending are listed in advance per the change-notice commitment in section 2 — they are not yet engaged and will only become active once the corresponding accounts are configured. Each will set cookies only after marketing- or analytics-consent opt-in.

Sub-processor	Service	Data categories	Location	Transfer mechanism
Supabase, Inc.	Managed PostgreSQL database, authentication, and file storage	Account data, shipping and container data, authentication events, support records	United Kingdom (eu-west-2, London)	No international transfer (UK primary region)
Vercel, Inc.	Application hosting, edge network, deployment, web analytics	HTTP request metadata, deployment logs, aggregated page-view counts	United States, with global edge presence	UK International Data Transfer Agreement; EU-US Data Privacy Framework (Vercel is self-certified)
Anthropic, PBC	Claude API — booking email parsing and alert text generation	Booking and shipment data submitted as prompts (no customer data used for model training)	United States	UK Addendum to EU Standard Contractual Clauses under the Anthropic Data Processing Addendum
Twilio Inc.	SMS and WhatsApp alert delivery	Mobile telephone numbers, alert message content	United States and Ireland	UK Addendum to EU Standard Contractual Clauses under the Twilio DPA
Stripe Payments UK, Ltd.	Payment processing, subscription management, billing	Billing contact details, transaction metadata (card data is held by Stripe, not by Standard Tonnage)	United Kingdom (Stripe UK), with Stripe, Inc. as controller in the United States for certain processing	UK adequacy (Stripe UK) and Standard Contractual Clauses for Stripe, Inc.
Google LLC (Google Workspace)	Business email, calendar, document storage for Standard Tonnage staff	Customer and prospect correspondence, internal documents	United States, with EU data regions available	EU-US Data Privacy Framework and UK Extension
GitHub, Inc. (Microsoft)	Source code hosting, CI, dependency and secret scanning	Source code, build logs, authentication metadata for Standard Tonnage staff	United States and Ireland	EU-US Data Privacy Framework and UK Extension
Carrier tracking APIs	Container event data retrieval (Maersk, CMA CGM, Hapag-Lloyd, MSC and similar)	Container reference numbers, booking references, vessel and port events	Various (each carrier operates globally)	Contract with each carrier under their published API terms; no personal data of the customer's staff is transmitted
Google LLC (Analytics + Ads)Pending	Google Analytics 4 and Google Ads conversion tracking	Aggregated page-view metrics; advertising identifiers (only after marketing-consent opt-in)	United States, with EU regional processing for Analytics	EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses
Meta Platforms Ireland LimitedPending	Meta Pixel — conversion tracking for Facebook and Instagram ad campaigns	Page-view events; advertising identifiers (only after marketing-consent opt-in)	Republic of Ireland (controller for EEA / UK)	EEA processing; for any onward transfer to Meta Platforms, Inc., the EU-US Data Privacy Framework and UK Extension
LinkedIn Ireland Unlimited CompanyPending	LinkedIn Insight Tag — conversion tracking for LinkedIn ad campaigns	Page-view events; advertising identifiers (only after marketing-consent opt-in)	Republic of Ireland (controller for EEA / UK)	EEA processing; for any onward transfer to LinkedIn Corporation, the EU-US Data Privacy Framework and UK Extension
PostHog Inc. (eu.posthog.com)Pending	Product analytics — anonymous usage events for in-product feature improvements	Anonymous identifier, in-app event metadata (only after analytics-consent opt-in)	European Union (eu.posthog.com tenant — Frankfurt)	Processing within the EEA; no UK / EEA international transfer

4. What we do not use

We do not sell customer data. We do not share customer data with third parties for their own marketing purposes. We do not use consumer-grade AI services (for example, public ChatGPT) to process customer data. We do not engage sub-processors to process customer data outside the list above without following the change-notice process in section 2.

5. Customer objections

If, following a change notice, a customer reasonably objects to a new sub-processor on grounds relating to data protection, we will work with the customer in good faith to find a resolution. Where no resolution is possible, the customer may terminate the affected subscription without penalty.

6. Version history

4 May 2026: Added Google LLC, Meta Platforms Ireland, LinkedIn Ireland, and PostHog Inc. to the sub-processor list, marked Pending until marketing/analytics accounts are configured. They will be moved to Active on the date their respective tags first deploy. Customers will receive a 30-day notice before any pending entry becomes active in production.
21 April 2026: Initial publication.