Legal
Sub-processors Sub-processors.
The third parties that process personal data on our behalf, what they do, and where they are.
Last updated: 3 August 2026
PropertyGoose uses a small number of carefully chosen providers to deliver the platform. This page lists every one of them that may process personal data, so that agencies, landlords and applicants can see exactly who is involved.
Who processes data on our behalf
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Application database, authentication and document storage | All platform data, encrypted at rest | United Kingdom / EEA |
| Amazon Web Services (AWS) | Application hosting and infrastructure | All platform data in transit and at rest | United Kingdom (eu-west-2) |
| Creditsafe UK | Identity verification, credit and affordability data | Applicant name, date of birth, address history | United Kingdom |
| TransUnion International UK | Second-agency credit and identity verification where the first check cannot verify an applicant | Applicant name, date of birth, address history | United Kingdom |
| Didit | Identity document and facial-similarity verification | Identity document images, facial image, verification result | EEA |
| Resend | Transactional email delivery | Name, email address, message content | EEA / United States (UK IDTA safeguards) |
| Twilio | SMS delivery for reminders and chase messages | Name, mobile number, message content | EEA / United States (UK IDTA safeguards) |
| Stannp | Print and postal delivery of arrears letters and notices | Name, correspondence address, letter content | United Kingdom |
| Stripe | Payment processing and subscription billing | Agency billing contact and payment details | EEA / United States (UK IDTA safeguards) |
| Anthropic | AI assistance features within the platform | Only the content submitted to that feature; not used to train models | United States (UK IDTA safeguards) |
Credit reference agencies are not ordinary sub-processors
Creditsafe and TransUnion act as independent controllers of the credit data they hold, not merely as processors for us. That means your rights in relation to your credit file — access, correction, and disputing an entry — are exercised with them directly. Their handling is described in the Credit Reference Agency Information Notice (CRAIN), which is linked from our referencing form and from their own websites.
How we govern them
- Each provider is engaged under a written contract containing data protection terms.
- Providers may only process personal data on our documented instructions, and may not use it for their own purposes.
- Where a provider processes data outside the UK, we rely on an adequacy decision or the UK International Data Transfer Agreement / Addendum.
- Providers are assessed before engagement and reviewed as part of our ongoing security review.
Changes to this list
We update this page when a provider is added, removed or replaced. Agency customers who wish to be notified in advance of a change of sub-processor can ask us to add them to the notification list by emailing info@propertygoose.co.uk. Where a customer's contract provides a right to object to a new sub-processor, that right is unaffected by this page.