Sub-processors
Last updated 19 October 2026
What this list is
These are the third parties that process personal data or customer engineering data on our behalf to run CertProve. We use no others. Each one is bound by a written agreement, and we remain responsible to you for what they do. This page is the list our privacy notice and our data processing agreement refer to.
The list
| Service | Legal entity | Purpose | Data | Location | When |
|---|---|---|---|---|---|
| Google Cloud (Cloud Run, Cloud SQL, Cloud Build) | Google Cloud EMEA Limited, Dublin, Ireland (Google LLC group) | Hosting the application and its database; building each release. | All customer data: account records and the programme data an organisation uploads or creates. | The application runs in europe-north1 (Finland) and the database in europe-west3 (Germany); encrypted backups in the EU multi-region. All inside the EU, encrypted at rest by Google Cloud. | Always. |
| Google Workspace (Gmail) | Google Cloud EMEA Limited | Sending account and service email from info@certprove.com, and receiving mail sent to us. | Email addresses, names and the content of the messages exchanged. | Google Workspace, EU data region where configured; otherwise Google’s global infrastructure. | Always. |
| Google Analytics 4 | Google Ireland Limited | Measuring how the public website is used. | Anonymous, aggregated usage signals in cookieless consent mode by default; an analytics cookie only if a visitor chooses Accept all. Nothing from the signed-in product. | Google’s infrastructure. | Public website only. Never inside the product. |
| Google Gemini API (the co-pilot) | Google Ireland Limited | The optional drafting and search assistant. | The text of the artefact the assistant is asked about (a requirement, a failure condition, a search query), sent at the moment of the request and not used to train models under the API terms. Nothing is stored by us at the provider. | Google’s infrastructure; an organisation can point the assistant at an EU or on-premises gateway of its own instead. | Off by default. Switched on for an organisation only at its request, and an organisation can turn it off again or supply its own key and endpoint. Everything load-bearing in the product runs with it off. |
What is not on the list, and why
- No payment processor. Licences are invoiced; we hold no card details.
- No customer-support or chat tool. Support is by email to info@certprove.com.
- No error-tracking or session-recording service. Diagnostics stay inside Google Cloud’s own logging.
- No model training. Customer data is never used to train any model, ours or a provider’s.
Changes
We will update this page and email the administrator of every customer organisation at least 30 days before adding or replacing a sub-processor that handles customer data. A customer may object in writing within that period; if we cannot resolve the objection, the customer may terminate the affected service and we refund any prepaid fees for the remainder of the term.
CertProve Ltd, company number 17476413, 128 City Road, London EC1V 2NX. Questions to info@certprove.com.