dpowSub-processors
Last updated 6 October 2026
DPOW Group Ltd ("dpow") uses the following companies to provide dpow.app. Each processes customer personal data only to provide its part of the service, under a written agreement with dpow. We will give customers notice before adding or replacing a sub-processor, as our data processing agreement sets out.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the app, running its server code, content delivery and request logs; usage analytics on the Datum client portal | Content delivery worldwide. Ask us for the server region |
| Supabase Inc. | Database, user sign in and private file storage: account data, project and register data, the audit trail, chat history, uploaded files, and files held when SharePoint refuses them | Ask us for the region |
| OpenAI | AI drafting (setup reading, documents, fee proposals, scope register, deliverables, programme dates, RFI drafts), chat answers, text search and voice note transcription: text and voice notes from tender and contract documents, register rows and chat questions | Ask us for the region |
| Anthropic | AI report narrative, chat answers, evidence gap narrative, and site photo checks when switched on: register extracts, chat questions, selected document text and site photos | Ask us for the region |
| Resend (Plus Five Five, Inc.) | Sending service emails: recipient name and email address, and the email content | United States |
| Stripe | Payments and invoices: payer and invoice recipient name, email, company and amounts. Card data is handled by Stripe only | Transfers to Stripe, LLC in the United States, under Stripe's Data Transfers Addendum |
| Twilio Inc. or Meta Platforms (WhatsApp Cloud API) | The WhatsApp project assistant, when a customer uses it: the linked phone number, questions and answers | Ask us |
Not sub-processors
- Microsoft. dpow reads and writes the customer's own Microsoft 365 tenant as the signed in user. Microsoft processes that content for the customer under the customer's own Microsoft agreement.
- AI providers chosen by the customer. If a customer enters its own AI key or its own AI provider address, that provider acts for the customer under the customer's own contract.
- jsDelivr and IMG.LY. When a user sets a profile photo, the browser downloads a background removal library from jsDelivr (and may download model files from IMG.LY). The photo is processed in the user's browser and is not sent to them. Their servers see the user's IP address.
Changes
We will update this list before a new or replacement sub-processor starts work, and tell customer admins by email. To ask about a provider, email pc at dpow.co.uk.