Sub-processors

This list now describes what is actually deployed, not a proposed architecture. Each vendor below was verified against the running system on 7 September 2026. What is still outstanding is the paperwork: for each entry marked confirmation outstanding we have not yet confirmed that a data processing agreement is executed and that the transfer mechanism named matches it. Those entries describe our position, not a contract you can rely on. This page has not been reviewed by a data protection solicitor.

Core infrastructure

These process customer personal data as an inherent part of running the platform. They cannot be disabled without the service ceasing to function.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Oracle Cloud Infrastructure Oracle Corporation	Virtual server hosting the application, the Student Hub and the marketing site. Uploaded documents taken through the platform's own upload path are stored on this server's disk.	All data in transit; documents stored on disk	United Kingdom (London)	None required — UK
Neon Inc.	Managed PostgreSQL database hosting. Stores all structured student and agency records.	All platform data	United States (AWS us-east-1, N. Virginia)	UK IDTA — confirmation outstanding
Cloudinary Ltd	Storage and delivery of uploaded student documents taken through the document vault, and of agency logos.	Passports, transcripts, financial evidence and other uploaded documents; agency brand assets	To be confirmed	UK IDTA — confirmation outstanding
Namecheap, Inc.	Authoritative DNS for admitai.co.uk, and mailbox hosting for our own @admitai.co.uk addresses.	Correspondence sent to us; DNS query metadata	United States	UK IDTA — confirmation outstanding

Where your data actually sits, stated plainly. The application server and the documents on its disk are in London. The database is not — it is hosted in the United States, which means every structured student record involves a transfer outside the UK. Our Privacy Policy and DPA previously said all customer data was held in the UK and the EEA. That was wrong, and this page is the corrected position. We are reviewing whether to migrate the database to a UK or EU region or to document the transfer properly; until that is resolved and the underlying agreements are confirmed, treat the transfer bases above as stated intent rather than as executed contracts, and ask us before you rely on them.

AI and document processing

Used to generate assessment drafts, read uploaded documents and draft communications.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Google LLC Gemini API	Language model inference for assessment reports, shortlist reasoning, SOP scaffolding and drafted replies. Vision OCR for document extraction.	Student profile fields and document images, transmitted per request	Global (Google-managed) — not region-pinned	UK IDTA — confirmation outstanding
Google LLC Docs Viewer	Renders an uploaded PDF or document in the browser when staff or a student open it from the document vault. The document's storage URL is passed to Google, which fetches the file to display it.	The uploaded document itself	Global (Google-managed)	UK IDTA — confirmation outstanding

What we send, and what we don't. Only the fields required for a given task are transmitted — a shortlist request sends academic and budget data, not a passport scan. No agency or student is identified to the provider by name where a reference ID will do the job.

Two things we previously claimed here that we could not stand behind. This page used to say the Gemini API runs in an EU or UK region and that our AI providers are engaged under enterprise terms barring training on customer content. We call Google's Gemini API over its general endpoint, which is not pinned to a region, and the no-training guarantee depends on the commercial tier that key sits on — which we are confirming rather than asserting. Separately, the document viewer above is a real flow we had not listed: opening a document in the vault hands its URL to Google. We are replacing that viewer with in-app rendering.

Communication channels

These are connected at your instruction, using your own accounts. If you do not connect a channel, we do not process data through it.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Meta Platforms Ireland Ltd	WhatsApp Business Platform — student messaging, milestone notifications and document chasers.	Phone numbers, message content	Ireland / US	EU SCCs + UK IDTA
Google LLC Gmail and Calendar	Gmail and Google Calendar integration where you connect an account — offer letter monitoring and appointment booking. Also our only outbound mail transport: every verification code, set-password link and platform notification we send passes through a Google mailbox, whether or not you have connected an account of your own.	Email content, calendar entries	Global (Google-managed)	UK IDTA — confirmation outstanding

Correction. This row previously described the Gmail integration as optional and limited to agencies that connect a Google Workspace account. That understated it: all platform email leaves through a Google mailbox regardless, so Google processes transactional mail for every agency. We also listed Microsoft Ireland Operations Ltd (Outlook / Microsoft 365) and Twilio Ireland Ltd (transactional SMS) here. Neither is built and neither receives any data. They have been removed, and will reappear on this page with 30 days' notice before either is switched on.

Business operations

These process agency account and billing data, for which we act as controller. They do not have access to student records.

Sub-processor	Purpose	Data processed	Location	Transfer basis
Sentry (Functional Software, Inc.)	Error monitoring and crash reporting, so faults are found before you report them.	Error traces with personal data scrubbed; user ID only	EU region	UK adequacy (EEA)

Correction. This section previously listed Stripe Payments Europe Ltd for subscription billing and Plausible Analytics for website analytics. Neither is in use. Billing is handled manually and we hold no card details at all — not because a payment provider shields us from them, but because we never collect them. No analytics product runs on this website, which is why you have not been asked to accept a cookie banner: the only cookies we set are the ones the platform needs to keep you logged in.

Not sub-processors

Two categories are frequently assumed to be on this list and are not:

Universities and application portals. When you submit an application, the university becomes an independent controller of that student's data. They are not our sub-processor and we have no contract with them governing their handling of it.
Affiliate partners. The Settle IQ module is live, but no affiliate partner is currently contracted, and none receives student data today. Accommodation, forex and insurance partners would receive student data only where a student chooses to use that service, and would act as independent controllers when they do. We will publish any such arrangement here before a partner receives any student data.

Objecting to a sub-processor

You may object to a new sub-processor on reasonable data protection grounds within 30 days of our notice. Write to privacy@admitai.co.uk setting out your concern. We will work with you on an alternative. If none can be found, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees, as set out in section 7 of our Data Processing Addendum.

Change history

Date	Change	Detail
7 September 2026	Corrected against the deployed system	Added: Oracle Cloud Infrastructure (application hosting), Cloudinary (document storage), Namecheap (DNS and our mailboxes), Google Docs Viewer (in-browser document rendering). Removed: Vercel, Cloudflare, Microsoft, Twilio, Stripe and Plausible — none of them is engaged or receives any data. Changed: the database is in the United States, not Frankfurt; the Gemini API is not region-pinned; Google carries all of our outbound email, not only the agencies who connect an account.
1 August 2026	Initial publication	First version, covering the Phase 1 platform — AdmitOps and Student Hub.

We keep every prior version of this page. Ask us if you need one for your own compliance records.