Sub-processors
Last updated: 8 June 2026. For notification of changes, see Terms of Service clause 15.3(e).
N90 Labs Limited (trading as Squigggle) engages the following sub-processors in providing the Service. A sub-processor is a third-party vendor that processes personal data on our behalf.
| Sub-processor | Purpose | Data processed | Location | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database, object storage, and authentication. All Customer Content (uploaded documents, signed documents, audit trails, account data, signer metadata) is stored here. Runs on underlying AWS infrastructure in the AWS London region (eu-west-2). | Account data, Content, authentication credentials | United Kingdom (London region) | UK IDTA / UK Addendum to EU SCCs |
| Vercel, Inc. | Application hosting, serverless compute, API request handling. Static assets served via a global edge network; Functions execute in the London (lhr1) region. Vercel's operational control plane, deployment logs, and billing operate from the United States. | Account data, Content (in transit during request processing), access logs | Compute: United Kingdom (lhr1). Control plane and operational logs: United States. | UK IDTA / UK Addendum to EU SCCs |
| Resend (Resend Inc.) | Transactional email delivery, including signer Email OTP verification codes, envelope invitations, reminders, and completion notifications. Email content is transient and retained only for operational logging windows. | Email addresses, email subject + body content, delivery metadata | United States | UK IDTA / UK Addendum to EU SCCs |
| Stripe, Inc. / Stripe Payments UK Ltd | Payment processing for Credit Bundles, Monthly Plan subscriptions, and Add-Ons. Squigggle does not receive or store card details; payments are handled entirely on Stripe-hosted pages. | Billing contact details, transaction amounts, Stripe customer ID | United States + Ireland (UK acquiring via Stripe Payments UK Ltd) | UK adequacy decision (EU) + UK IDTA (US). Stripe's own sub-processor list |
Supabase, Inc.
- Purpose
- Database, object storage, and authentication. All Customer Content (uploaded documents, signed documents, audit trails, account data, signer metadata) is stored here. Runs on underlying AWS infrastructure in the AWS London region (eu-west-2).
- Data processed
- Account data, Content, authentication credentials
- Location
- United Kingdom (London region)
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs
Vercel, Inc.
- Purpose
- Application hosting, serverless compute, API request handling. Static assets served via a global edge network; Functions execute in the London (lhr1) region. Vercel's operational control plane, deployment logs, and billing operate from the United States.
- Data processed
- Account data, Content (in transit during request processing), access logs
- Location
- Compute: United Kingdom (lhr1). Control plane and operational logs: United States.
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs
Resend (Resend Inc.)
- Purpose
- Transactional email delivery, including signer Email OTP verification codes, envelope invitations, reminders, and completion notifications. Email content is transient and retained only for operational logging windows.
- Data processed
- Email addresses, email subject + body content, delivery metadata
- Location
- United States
- Transfer mechanism
- UK IDTA / UK Addendum to EU SCCs
Stripe, Inc. / Stripe Payments UK Ltd
- Purpose
- Payment processing for Credit Bundles, Monthly Plan subscriptions, and Add-Ons. Squigggle does not receive or store card details; payments are handled entirely on Stripe-hosted pages.
- Data processed
- Billing contact details, transaction amounts, Stripe customer ID
- Location
- United States + Ireland (UK acquiring via Stripe Payments UK Ltd)
- Transfer mechanism
- UK adequacy decision (EU) + UK IDTA (US). Stripe's own sub-processor list
Not currently engaged (planned for later releases)
- Identity verification sub-processor (for the forthcoming AES with Identity Verification Signature Level) — will be added to this list with at least 30 days' notice before it is engaged.
- Qualified trust service provider (for the forthcoming QES Signature Level) — same.
- Error monitoring, uptime monitoring, and SMS/WhatsApp delivery partners — will be added as engaged.
How we notify you of changes
When we engage a new sub-processor or replace an existing one, we will provide at least 30 days' advance notice by email (to the Account Admin) or by updating this page. If you object to the change, your sole remedy is to terminate the Agreement in accordance with clause 20 (Suspension and Termination) of the Terms of Service.