Sub-processors
Last updated: 6 October 2026
Careframe uses a small number of other companies to run the platform. Where they handle personal data for our customers, they are our sub-processors, as described in our Data Processing Terms. Each one is bound by written terms that protect the data at least as well as ours do, and we remain responsible for what they do.
Who they are
Supabase
The database, sign-in and file storage: every record, document and photo a home keeps in Careframe.
Where: European Union (Frankfurt, Germany).
Vercel
Hosts and runs the Careframe website and app, and counts page visits without cookies.
Where: Servers in the European Union (Frankfurt, Germany); Vercel is a United States company.
Resend
Sends Careframe's emails: invitations, sign-in links, reminders and notifications.
Where: United States.
Sentry
Error reports, so we can find and fix faults. We keep personal details out of these reports as far as we can.
Where: European Union or United States, depending on the account's data region.
Cloudflare
Turnstile, the check on the public job application form that stops automated spam.
Where: Global network; Cloudflare is a United States company.
Data that leaves the UK
The European Union is covered by the UK’s adequacy regulations, so data held there is protected in the same way as in the UK. Where a provider handles data in the United States or elsewhere, the transfer is made under a recognised UK safeguard: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or otherwise the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
When this list changes
We update this page before a new sub-processor starts handling customer data, and we tell each customer’s Director by email at least 30 days beforehand, so they can raise a reasonable objection. The date at the top of this page shows when it last changed.
Questions
Email hello@careframe.co.uk.