Last reviewed: May 2026
Subprocessors & International Transfers
This page lists the suppliers (subprocessors) we rely on to run GPWidget and explains how international data transfers are controlled. It is the public summary of our internal Subprocessor & International Transfer Register.
In short
GPWidget is built on a small, transparent set of UK-hosted subprocessors. Primary data stays in the UK. Where any limited supplier processing may occur outside the UK, it is covered by the UK International Data Transfer Addendum (UK IDTA) and/or Standard Contractual Clauses (SCCs) — contractual safeguards for international data transfers.
1. Approved subprocessors
| Supplier | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage, infrastructure, backup and security | UK (eu-west-2 London) |
| Amazon Bedrock | AI inference for AI-assisted retrieval (no content used for model training) | UK (AWS eu-west-2 London) |
| Amazon SES | System email delivery and notifications | UK / AWS managed |
| SendGrid | Transactional email delivery | UK/EU managed service |
2. How international transfers are controlled
GPWidget is designed to minimise international transfers. Primary application data, organisational content, AI prompts and responses, audit records and backups all remain hosted and processed within the United Kingdom.
- UK-first by design — the platform keeps organisational and personal data within the UK region wherever possible.
- No model training — customer organisational content is never used to train foundation AI models.
- Safeguarded exceptions — where limited supplier processing outside the UK may occur in support of operational services (for example, certain email delivery operations), it is covered by the UK IDTA and/or SCCs.
The bottom line
A short, transparent subprocessor list — AWS, Bedrock, SES and SendGrid — with primary data kept in the UK, no customer content used for model training, and UK IDTA/SCC safeguards for any limited processing outside the UK.