Sub-processors
Version 2026-10-08 · last updated 2026-10-08
The third parties that process personal data on MWaste's behalf under the Data Processing Agreement. Owners are emailed at least 30 days before a sub-processor is added or replaced.
| Sub-processor | Purpose | Data | Location | When |
|---|---|---|---|---|
| Vercel Inc. | Application hosting, serverless functions, CDN, build pipeline | All application traffic; logs with IP addresses and request paths | Functions and data in London (lhr1); global edge network; USA for build and support | Always |
| Neon Inc. | PostgreSQL database | All records your company creates and all account data | UK (London, AWS eu-west-2) — encrypted at rest and in transit | Always |
| Cloudflare, Inc. | Object storage (R2) for photos, signatures, documents and exports | Uploaded files and generated documents under company-scoped keys | Western Europe storage; global network | Always |
| Resend, Inc. | Transactional email (invites, alerts, digests, customer packs) | Recipient email addresses, names and the message content | USA (international transfer safeguards: UK IDTA / Addendum) | Always |
| Stripe Payments Europe, Ltd. | Subscription billing and card payments | Billing contact, card details (held by Stripe only), invoices | EU / USA (Stripe's own safeguards) | Always |
| Google LLC | Sign in with Google (only when a user chooses it) | Email address and name at sign-in | Global; EU / USA | Only when used |
| Microsoft Corporation (Entra ID) | Sign in with Microsoft 365 (only when a company enables it) | Email address and name at sign-in; the tenant's verified domain | EU / USA | Only when enabled |
| Functional Software, Inc. (Sentry) | Error monitoring | Error traces with request paths and a user / company id; no record content | EU (Frankfurt) or USA depending on configuration | Only when a DSN is configured |
| what3words Ltd | Three-word addresses on signatures and positions | GPS coordinates at the moment of capture | UK | Always |
| Routing provider (openrouteservice / Mapbox, as configured) | Road routes and ETAs on the Live Map | Vehicle positions and destinations | EU (openrouteservice, Heidelberg) or USA (Mapbox) | Only when a routing key is configured |
| Esri (ArcGIS) | Satellite map tiles (proxied through MWaste) | Tile coordinates only — no identifiers | USA / global CDN | Always |
| OpenStreetMap Foundation | Street map tiles on the Live Map | Tile coordinates and the viewer's IP address | UK / EU | Always |
| Defra (Digital Waste Tracking service) | Receipt-of-waste submissions — only when an Owner switches submission on | The waste record fields the regulations require, including producer and carrier names and addresses | UK (government service) | Only when switched on |
Reference services (not sub-processors)
Called server-side with no personal data of yours — a registration number, a postcode, a date:
| Service | Used for |
|---|---|
| DVLA Vehicle Enquiry Service and DVSA MOT History | Vehicle details and MOT history by registration |
| Environment Agency public registers | Carrier, broker and dealer registration checks; exemption checks |
| postcodes.io | Postcode → country check for sites (England only) |
| gov.uk | Bank holiday calendar (England and Wales) and reference guidance |