Subprocessors
Last updated: 22 July 2026. This list identifies the third parties engaged to process personal data in the operation of Dispatch, per §5 of the Data Processing Agreement. Customers are notified at least 14 days before changes.
Infrastructure and delivery
| Subprocessor | Purpose | Location / transfer safeguard |
|---|---|---|
| Subset Enterprise (trading as Subset UK), company no. 09542306, 75 Millmarsh Lane, Enfield EN3 7UY, United Kingdom | Application hosting on private virtual servers: storage of knowledge bases, drafts, logs and backups | United Kingdom — for EU-based customers this is a transfer to a third country, covered by the European Commission's adequacy decision for the UK (Standard Contractual Clauses stand behind it should adequacy lapse) |
| Cloudflare, Inc. | Content delivery, DNS, TLS, tunnel transport, access authentication for portals | Global edge; EU–US Data Privacy Framework |
AI processing (drafting, summarisation, research)
| Subprocessor | Purpose | Location / transfer safeguard |
|---|---|---|
| Anthropic, PBC | Content drafting and analysis (Claude API) | USA; Data Privacy Framework / SCCs — API data not used for model training |
| Google LLC (Gemini API; Google Drive/Docs) | Research and drafting support; document storage of published content in the customer's Drive | USA/EU; Data Privacy Framework / SCCs — business API data not used for model training |
| Groq, Inc. | Fallback model inference | USA; SCCs — API data not used for model training |
Communications
| Subprocessor | Purpose | Location / transfer safeguard |
|---|---|---|
| Resend (Plus Five Five, Inc.) | Transactional email delivery (e.g. lead notifications, newsletters where configured) | USA; SCCs |
| Telegram (Telegram FZ-LLC) | Operational notifications and command channel, where the customer enables it | UAE/global; used only for notification content the customer configures |
Publishing destinations (at the customer's direction)
Social networks and publishing platforms (e.g. Bluesky, LinkedIn, X, Facebook, Instagram, Reddit) receive content only when the customer connects their own account and approves or schedules a post. They act as independent controllers under their own terms and are listed here for transparency rather than as subprocessors.