Every third party that processes personal data on CitadelAero’s behalf, what it does, where it does it, and the transfer mechanism that applies. Referenced by the Data Processing Agreement, which governs how changes to this list are notified.
1. How to read this register
1.1
CitadelAero’s products run on different infrastructure. A sub-processor listed against one product does not necessarily process data for another. The “Used by” column is therefore load-bearing, not decorative.
1.2
Sections 2 to 4 list sub-processors engaged where CitadelAero acts as a processor for customer data. Section 5 lists providers engaged where CitadelAero acts as a controller for the website — visitor analytics, and the storage of enquiries — and those are not sub-processors under Article 28 of the UK and EU GDPR or Article 19 of the Data Protection (Jersey) Law 2018, and are listed here for completeness because people ask.
1.3
JLEC Limited is established in Jersey. Jersey and the United Kingdom both benefit from European Commission adequacy decisions, and the United Kingdom treats Jersey as adequate. Transfers between the EEA, the UK and Jersey therefore require no additional transfer mechanism. Transfers to the United States are covered by the EU Standard Contractual Clauses and, for UK personal data, the UK International Data Transfer Agreement or Addendum.
1.4
The model provider retains no prompt and no response. Where a Chuck request reaches the outside model provider, it is held under zero data retention: the question and the passages retrieved to answer it exist for the length of the request and are not kept afterwards, and neither is used to train AI models. Clause 3.2 gives the detail. It rests on an account configuration rather than a provider default, so it is re-checked after any rebuild or replacement of that account.
2. SMS Platform
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc.United States (incorporated) | Database hosting and file storage. Holds all SMS Platform customer data, including uploaded documents and attachments. | European Union — Paris, France | EU SCCs (Modules 2 and 3); UK IDTA / Addendum |
| Vercel Inc.United States (incorporated) | Application hosting, content delivery, and serverless function execution. Processes data in transit; does not store customer records at rest. | EU edge infrastructure serves UK and EU traffic; company is US-headquartered | EU SCCs (Module 2); UK IDTA / Addendum |
3. Chuck
Different infrastructure entirely. Chuck does not run on the SMS Platform’s infrastructure. Customer documents, the regulatory corpus and the application database are held on dedicated hosting in the United Kingdom, and model inference by an outside provider is performed in the European Union. Neither Supabase nor Vercel processes Chuck data, and nor does Microsoft: Chuck sends no email through it, and its sign-in email is sent by WorkOS.
| Sub-processor | Purpose | Processing location | Transfer mechanism |
|---|---|---|---|
| OVHcloudOVH Groupe SAS and its group companies | Dedicated server hosting. Holds the application database, the regulatory corpus, uploaded customer documents and the document index at rest. | United Kingdom | UK / Jersey adequacy — no additional mechanism required |
| WorkOS, Inc.United States | Authentication and identity. Processes user email addresses and sign-in events to operate magic-link sign-in. | United States | EU SCCs (Module 3); UK IDTA / Addendum |
| Amazon Web ServicesAmazon Web Services EMEA SARL and its group companies | Language model inference via Amazon Bedrock. Processes the text of a question and the passages retrieved to answer it, for the duration of the request. | European Union — see clause 3.1 | Intra-EU / UK / Jersey adequacy — no additional mechanism required |
| Backblaze, Inc.United States (incorporated) | Encrypted off-site backup storage. Holds the nightly encrypted backup of the application database, the regulatory corpus, uploaded customer documents and persisted memory. Encrypted before it leaves the hosting server; Backblaze cannot read the contents. | European Union — Amsterdam, Netherlands | EU SCCs (Module 3); UK IDTA / Addendum |
3.1
Where inference runs today. This note concerns model inference performed by an outside provider. Processing CitadelAero performs on its own hosting is at clause 3.4. Model inference is performed through Amazon Bedrock against a European Union geographic inference profile, which keeps each request within the EU region set. The model developer is not a sub-processor of customer data on this route: the data-flow relationship is with Amazon Web Services, and the developer receives no customer data.
Stated plainly, on purpose. A customer choosing this product on the basis of where its data is processed is entitled to know where that is today, not where it is intended to be.
3.2
Retention by the inference provider. Queries are not persisted by the regulation engine and are retained only as the customer’s own chat history within the service. The inference provider’s own retention is governed by CitadelAero’s agreement with it. Zero data retention is in place: the inference account is configured with
data_retention_mode = none and Model Invocation Logging disabled, so no prompt and no generated response is retained by the provider once the response has been returned. Confirmed on the account on 28 August 2026. This is an account configuration rather than a default, and is re-checked after any change to the inference account.3.3
No model training. CitadelAero does not permit any sub-processor to use customer data to train, fine-tune or evaluate machine learning or artificial intelligence models. For occurrence report data this prohibition is absolute and is additionally recorded at clause 10.2.3(c) of the Master Services Agreement.
3.4
Self-hosted components. Document conversion and optical character recognition, text embedding, speech-to-text for dictation, the application database, the cache and the regulatory corpus all run on CitadelAero’s own dedicated hosting described in the OVH row above, in the United Kingdom. They are not separate sub-processors and no data is disclosed to a third party by their operation. Audio recorded for dictation is converted to text in memory for the duration of the request and is not written to storage or included in backups; no audio is sent to any third party.
4. Both products, and company-wide
| Sub-processor | Purpose | Used by | Transfer mechanism |
|---|---|---|---|
| Microsoft Corporation | Email for the SMS Platform, and for website contact-form enquiries and registrations of interest, sent through the Microsoft Graph API; and CitadelAero’s own company email and document storage (Microsoft 365, including SharePoint). Not used by Chuck. | SMS Platform; website; company-wide | EU SCCs (Module 3); UK IDTA / Addendum |
| Paddle.com Market LimitedEngland & Wales, no. 08815936 | Payment processing and VAT invoicing, as merchant of record. Holds billing contact and transaction data; CitadelAero never receives card details. | Both products | United Kingdom — no restricted transfer. Paddle’s own terms cover any onward US transfer |
5. Website analytics and enquiries — CitadelAero as controller
5.1
The providers below process website visitor and enquiry data on citadelaero.com, where CitadelAero acts as controller. They do not process customer data held in either Platform Service, and are not sub-processors under the Data Processing Agreement.
5.2
The analytics providers are loaded only where the visitor has consented to analytics cookies. See section 15 (Cookies) of the Privacy Policy.
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC / Google Ireland Limited | Google Analytics 4 — aggregate website usage statistics. | United States; Google Ireland for EEA and UK data | EU SCCs (Module 2); UK IDTA / Addendum |
| Microsoft Corporation | Microsoft Clarity — heatmaps and aggregate session recordings. Sets Microsoft identifiers, including MUID, which are shared across Microsoft properties such as Bing and Microsoft Ads. | United States | EU SCCs (Module 2); UK IDTA / Addendum |
| Vercel Inc. | Vercel Analytics — aggregate page-view and visit statistics. Cookieless: it sets nothing in your browser and identifies a visit by a hash of the request that is discarded daily, so it cannot follow you between days or across sites. | United States; EU edge infrastructure serves UK and EU traffic | EU SCCs (Module 2); UK IDTA / Addendum |
5.3
Website enquiries. Enquiries made through the contact form, and registrations of interest at citadelaero.com/interest, are stored in the database the website shares with the SMS Platform before they are emailed to CitadelAero, so that an email that fails to send does not lose them. They are not customer data, and they are not held in Chuck.
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc.United States (incorporated) | Database hosting. Stores contact-form enquiries and registrations of interest. | European Union — Paris, France | EU SCCs (Modules 2 and 3); UK IDTA / Addendum |
6. Changes to this register
6.1
CitadelAero will give customers not less than thirty (30) days’ notice before engaging a new sub-processor or replacing an existing one, by email to the customer’s notified contact and by updating this register.
6.2
A customer may object to a proposed change on reasonable data protection grounds within that period, in writing to privacy@citadelaero.com. The parties will discuss the objection in good faith. If it cannot be resolved, the customer may terminate the affected Order Form without penalty and receive a pro-rata refund of prepaid fees for the unexpired period.
6.3
CitadelAero may engage a replacement sub-processor without the notice period where necessary to address an urgent security or availability risk, in which case it will notify affected customers as soon as reasonably practicable.
6.4
Every sub-processor listed here is engaged under a written contract imposing data protection obligations no less protective than those in CitadelAero’s Data Processing Agreement. Copies of the relevant transfer mechanisms are available to customers on written request to privacy@citadelaero.com.
7. Subscribe to changes
7.1
Customers receive notice of changes automatically at their notified contact address. Anyone else who wishes to be notified may ask to be added to the notification list at privacy@citadelaero.com.
© JLEC Limited t/a CitadelAero · citadelaero.com · Version 1.9