Legal and security

Sub-processors

The services that help us run Yeardesk and process personal data for us, what each one does and where. Practices are told by email 30 days before this list changes.

Effective from [Effective date]

Draft. These documents are still being finalised and haven’t taken effect yet. Values still to be filled in are highlighted [like this].

Who they are

  • Cloudflare

    Always

    Runs the app (Cloudflare Workers) and delivers every page and request. Also DNS, protection against attacks and bots, encrypted database backups (R2), and forwarding email sent to our addresses.

    Data
    Everything sent to and from Yeardesk passes through it, including visitors’ IP addresses. Backups hold a copy of the database, encrypted before they leave it.
    Where
    Worldwide: each request is handled at the Cloudflare data centre nearest the visitor. Backups are stored in the EU.
    Company
    Cloudflare, Inc. (United States)

  • Neon

    Always

    Hosts the database: accounts, workspaces and everything practices put in.

    Data
    All data stored in Yeardesk.
    Where
    London, United Kingdom (AWS eu-west-2).
    Company
    Neon (United States)

  • Resend

    Always

    Sends Yeardesk’s emails: sign-up confirmations, password resets, sign-in codes, invitations and service notices.

    Data
    Recipient’s name and email address, and the email itself.
    Where
    Ireland, EU (AWS eu-west-1).
    Company
    Resend (United States)

  • Sentry

    Always

    Tells us when something in the app goes wrong, so we can fix it.

    Data
    Technical details of errors. Set up not to send names, email addresses, client data, cookies or request contents.
    Where
    Frankfurt, Germany (Sentry’s EU data region).
    Company
    Functional Software, Inc., trading as Sentry (United States)

  • Microsoft

    Only for practices whose team signs in with Microsoft

    Signs people in with their Microsoft 365 work account.

    Data
    Name, email address and an account identifier, sent by Microsoft when someone signs in.
    Where
    Wherever the practice’s own Microsoft 365 tenant is hosted.
    Company
    Microsoft Corporation and its affiliates

Transfers outside the UK

Where a sub-processor handles personal data outside the UK, or is based in the United States, the transfer is protected as UK law requires: by UK adequacy regulations (which cover the EU), the UK extension to the EU–US Data Privacy Framework, or the ICO’s international data transfer agreement or addendum in our contract with that provider.

Changes to this list

Before we add or replace a sub-processor, we email every workspace owner at least 30 days ahead and update this page. If you object on reasonable data protection grounds, tell us at [privacy contact email] before the change takes effect. The data processing addendum explains what happens next.