The companies we use to provide Composure247, what each does, and where.
These are the companies CITSYS LIMITED uses to provide Composure247, what each does, and where. Each handles personal data only on our instructions, under a contract that protects it. This list is Annex 3 of our Data Processing Agreement and section 9 of our Terms of Service.
| Sub-processor | What it does | Personal data it handles | Where |
|---|---|---|---|
| Supabase | Database, sign-in and server functions | All customer personal data | UK (London) |
| Vercel | Hosts the web application | Web request details only (IP address, browser) | Global edge network |
| Resend | Sends emails | Recipient email addresses and message content | EU (Ireland) |
| Twilio | Sends texts and WhatsApp messages; receives replies and delivery reports | Recipient phone numbers, message content, replies and delivery status | United States |
| Meta (WhatsApp Business Platform, through Twilio) | Carries WhatsApp messages and replies, only for contacts who have opted in to WhatsApp updates | Recipient phone numbers, message content, replies and delivery status | Global (Meta data centres, including the United States) |
| Anthropic | AI drafting | The incident details used to draft a message; not used for training, and deleted within 30 days | United States |
| Cloudflare | The "not a robot" check on the sign-up page | Browser signals of the person signing up; no customer personal data | Global |
| Microsoft | Single sign-on and user provisioning, only if you connect Microsoft Entra ID | Sign-in assertions and directory attributes | Your Microsoft tenant |
Stripe takes card payments for Composure247 subscriptions and message credits. It handles our customers' own billing details (the billing contact, billing address, VAT number and card), not the personal data our customers hold in Composure247, so it is not a sub-processor of that data and is not part of this list. Our Privacy Notice explains how it handles billing details.
We update this page at least 30 days before a new sub-processor starts handling customer personal data, and we email account administrators at the same time. You can object on reasonable data protection grounds, as our Data Processing Agreement (section 6) explains.
Questions: legal@composure247.com.
Composure247