amber.systems subprocessor list

Version 2026-08-18 - last updated 18 August 2026

1. About this list

This list identifies service providers that amber systems ltd, trading as amber.systems, may use to process Customer Personal Data on behalf of a Customer.

A provider is a Subprocessor only where it processes Customer Personal Data for a Service selected by that Customer. Not every provider is used for every Customer, Service or data item.

The exact contracting entity, deployment region and data-centre location may vary by account, Service and Customer configuration. The provider brand is used below to identify the relevant service family.

2. Infrastructure, hosting, networking and storage

Provider	Purpose	Potential processing location and notes
OVHcloud	Cloud and dedicated hosting, compute, network and related infrastructure	Customer-selected UK, EEA or other available region; limited support, security and account processing may occur elsewhere under provider controls.
Amazon Web Services (AWS)	Cloud compute, storage, database, networking and managed infrastructure	Customer-selected region where configured; global support and security operations may process limited metadata.
Google Cloud Platform (GCP)	Cloud compute, storage, database, networking and managed infrastructure	Customer-selected region where configured; global support and security operations may process limited metadata.
Microsoft Azure	Cloud compute, storage, database, networking and managed infrastructure	Customer-selected region where configured; global support and security operations may process limited metadata.
Latitude.sh, part of the Megaport group	Bare-metal, accelerated compute, storage and network infrastructure	Selected deployment location; account, support and operational processing may involve Megaport group locations.
NetActuate	Hosting, network, routing, connectivity and data-centre infrastructure	Selected service location; network traffic may transit locations required for routing and resilience.
Hetzner	Cloud, dedicated hosting, storage and network infrastructure	Primarily selected European or other available location; support and security metadata may be processed elsewhere.
Scaleway	Cloud compute, object storage, backup and network infrastructure	Selected EEA region where configured; support and operational metadata may be processed elsewhere under provider controls.
Cloudflare	DNS, proxying, content delivery, security, serverless compute, object storage and email routing	Globally distributed network. Region, data-localisation and routing controls are used where available and appropriate.
IONOS	Hosting, compute, storage and network infrastructure	Selected UK, EEA or other available location; limited support and account processing may occur elsewhere.
BunnyWay d.o.o. (bunny.net)	Content delivery, edge security and storage delivery	Globally distributed edge network; origin storage location and routing depend on the selected configuration.
Backblaze	Object storage, backup and recovery	Selected available storage region; account, support and security processing may occur elsewhere.
Modal Labs	Serverless and accelerated compute used to execute application and AI workloads	Workload region depends on selected capacity and provider availability; operational metadata may be processed in the United States or other disclosed locations.

3. Payments, accounting, email and communications

Provider	Purpose	Potential processing location and notes
Stripe	Payment processing, billing, refunds, fraud prevention and transaction administration	United Kingdom, EEA, United States and other locations used by Stripe and payment networks. Stripe may act as an independent controller for some regulatory, fraud and payment-network processing.
Google Workspace	Business email, document storage, calendars, productivity and collaboration	Selected data region where available; global support, security and service metadata processing may occur.
Forward Email	Email forwarding, routing and delivery	Message data may transit infrastructure required to route and deliver email; processing locations depend on configuration and delivery path.
FreeAgent	Accounting, bookkeeping, invoicing and financial administration	Primarily United Kingdom and provider-disclosed support infrastructure. FreeAgent may act as an independent controller for limited legal and service-administration purposes.
Telnyx	Telephone numbers, voice, messaging, call routing and communications infrastructure	Communications may route globally. Telnyx may act as an independent controller for some billing, regulatory and telecommunications metadata.
Twilio	Telephone numbers, voice, messaging, call routing and communications infrastructure	Communications may route globally. Twilio may act as an independent controller for some account, billing, regulatory and communications-usage processing.

4. Artificial-intelligence services

Provider	Purpose	Data handling and location
OpenAI	Model inference and related business/API functionality	Customer Content is submitted only through approved services and configurations covered by our applicable zero-data-retention arrangements. It is not used to train provider models. Processing may occur in the United Kingdom, EEA, United States or another approved service region. Limited account, billing, security and request metadata may be retained separately.
Anthropic	Model inference and related business/API functionality	Customer Content is submitted only through approved services covered by our applicable zero-data-retention arrangements. It is not used to train provider models. Processing may occur in the United Kingdom, EEA, United States or another approved service region. Limited account, billing, security and request metadata may be retained separately.
OpenRouter	Routing requests to selected model providers through a unified API	Customer Content is restricted to approved zero-data-retention endpoints and downstream model providers and is not used for provider training. Processing may occur in the EEA, United States or another approved provider region. OpenRouter may retain limited activity, billing, security, token-count and latency metadata separately from request content.

5. Transfer safeguards

Where use of a provider creates a Restricted Transfer under UK data-protection law, amber.systems uses an applicable lawful mechanism, which may include:

• UK adequacy regulations, including a UK data bridge where the recipient is eligible;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission Standard Contractual Clauses;
• approved binding corporate rules; or
• another safeguard permitted by law.

Where required for an appropriate safeguard, amber.systems completes a data protection test and applies reasonable supplementary measures. Customer-selected data regions, encryption, access controls, data minimisation and zero-data-retention routing are used where appropriate.

6. Changes and objections

We will notify affected Customers of a new or replacement Subprocessor in accordance with the Data Processing Agreement, normally at least 14 days before the Subprocessor begins processing Customer Personal Data.

A Customer may object during that period on reasonable and documented data-protection grounds. Contact privacy@amber.systems to receive or discuss notices.

Urgent security, legal or provider-continuity changes may require shorter notice. We will explain the reason where legally and commercially possible.

7. Independent-controller processing

Some providers act as processors for one activity and independent controllers for another. Examples include payment-network compliance, fraud prevention, telecommunications records, account administration and a provider’s own security obligations. Their privacy notices apply to that independent processing.

8. Contact

Questions about this list or a particular Service can be sent to privacy@amber.systems.