All four services
Engaged for every client across all four FTH services.
| Sub-processor | Role and purpose | Legal entity and country | Processing location | Instrument | Date listed |
|---|---|---|---|---|---|
| Contabo GmbH | Infrastructure hosting: application servers, database, object storage holding encrypted backups, and the mail server. | Contabo GmbH, Germany | Platform, database, encrypted backups and the mail server within the European Union | Data processing agreements under Article 28 of the GDPR, concluded 24 August 2026, 29 August 2026 and 30 August 2026, covering all FTH subscriptions with the provider: compute, object storage and the mail server. They bind the processor under Article 28 GDPR; transfer of client data outside the European Union requires FTH's prior consent, and FTH selected server locations within the European Union for these subscriptions (panel region: EU for all three subscriptions). | 23 August 2026 |
| Cloudflare, Inc. | Edge network in front of the platform and the GBP MCP server used for the three managed services: DNS, denial-of-service protection and TLS termination. Traffic transits the edge; no client data is stored there. | Cloudflare, Inc., United States | Global edge network | Cloudflare Customer DPA v6.4 (3 April 2026). Provider sub-processor list: cloudflare.com/gdpr/subprocessors. | 23 August 2026 |
Managed services
Engaged only where the client takes FTH's managed services. A client using the platform alone is not affected by this section.
| Sub-processor | Role and purpose | Legal entity and country | Processing location | Instrument | Date listed |
|---|---|---|---|---|---|
| Anthropic PBC | AI-assisted analysis of review content within FTH's managed services. | Anthropic PBC, United States | United States | No data processing agreement is relied on for this channel. Content reaches the provider de-identified, so client personal data is not placed in it. | 23 August 2026 |
What this register covers
This register lists FTH's direct sub-processors. A sub-processor's own sub-contractors are governed by that sub-processor's agreement and published list, and a change there does not change this register.
Not sub-processors
The following are deliberately not listed above, because FTH does not engage them to process client personal data:
- Providers the client contracts directly. Where a client supplies its own AI API key, or configures its own receiving endpoint such as a CRM, that provider is engaged under the client's own contract and is not an FTH sub-processor.
- Tools used for FTH's own software development. Software FTH uses to build and maintain the platform, which does not process client personal data in the running service, is not a sub-processor.
- Google. Google is the source platform, accessed under the client's own documented and revocable authorisation, and is not an FTH sub-processor.
How this register changes
A new or replacement sub-processor appears on this page. Publication is the notice. There is no separate mailing, so this page is the place to check, and FTH may engage the sub-processor from the date it is listed.
A client may object on reasonable data protection grounds within thirty days of publication. FTH works with the client to address the objection, including by not using that sub-processor for the client's workspace where it supports an optional feature. Where the sub-processor is part of the platform's infrastructure and the objection cannot be resolved, the client may terminate the service that relies on it. Termination is limited to that service and does not affect the client's other services with FTH. An objection does not suspend the engagement.
The sub-processors listed when this register was first published were already engaged at that date, and publication disclosed them.
Every change is recorded in the changelog below, and the version number and last-updated date at the top of this page change with it.
Machine-readable copy
The same data is published at
/subprocessors.json, including version and updated_at, so that this register can
be cited and compared over time in an audit.
Changelog
| Version | Date | Change |
|---|---|---|
| 3.0 | 30 August 2026 | First publication of this register. It replaces the former reference to an annex of a separate data processing agreement. The version number matches the Data Protection Specifications it accompanies. |