Sub-processors
Last updated: October 2026
These are the companies Natterio uses to run the service. They form the sub-processor list referred to in our Data Processing Addendum and our Privacy Policy. We have a contract with each one that requires protection for personal data no weaker than the DPA.
| Company | What they do for us | Data involved | Where |
|---|---|---|---|
| Neon | Secure storage for your site and account information | Account data, site content, leads, and community member data | UK (London, AWS eu-west-2) |
| Cloudflare | Hosting, content delivery, security, file storage (R2), DNS, domain registration and email routing for custom domains | Request metadata (including IP addresses), uploaded images, and email being forwarded for custom domains | Global network; US-based company |
| Stripe | Payment processing for paid plans | Billing details you enter directly with Stripe; we keep only customer and subscription identifiers | US and EU; US-based company |
| Resend | Transactional email (sign-in links, notifications, lead alerts) | Recipient email address and the message content | US-based company |
| Anthropic | AI site generation and editing | What you type into the site builder (for example your name, description and brief). Not used to train their models. | US-based company |
| Unsplash and Pexels | Stock photography search | Search terms derived from your site brief. No personal data about you or your members is sent. | US/Canada-based companies |
| Google (Workspace and sign-in) | Business email for support, and optional "Sign in with Google" | Support correspondence; your Google email address and name if you choose Google sign-in | US-based company, with UK/EU data regions available |
| cron-job.org | Scheduled triggers for our maintenance jobs and uptime checks | No personal data. It only calls our own URLs on a timer. | Germany |
International transfers
Where a sub-processor processes data outside the UK or EEA, we rely on UK adequacy regulations where they apply, and otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Changes to this list
If we add or replace a sub-processor that handles community member data, we will update this page and give community owners reasonable notice by email before the change takes effect, so you have the chance to object on data protection grounds.
Questions? Email privacy@natterio.com.