Trust
Sub-processors. Who touches client data.
Client data is stored in London. The companies below process it for us, each under a written data protection agreement and UK GDPR transfer safeguards. Last updated 19 October 2026.
| Company | What it does | Where |
|---|---|---|
| Vercel Inc. | Hosting, encrypted document storage and the filing agent's runtime. AI processing through Vercel's AI Gateway, which routes requests to the AI model providers on Vercel's own sub-processor list, under terms that bar training on your data. | London for hosting and storage. AI processing may take place in the United States. |
| Neon Inc. | Database: matters, cited facts and filing records. | London |
| AgentMail Inc. | Email: notifications, and the inbox for the GOV.UK account created for each application. | United States |
| Google LLC (Workspace) | Bainary's own email. | Global |
| Stripe | Card payments. Receives no client data. | EU and United States |
We email firms at least 10 days before adding or replacing a sub-processor. A firm can object within 30 days; if we can’t resolve it, the firm can end the affected service without penalty and get unused credits back.