Reviewed copy — auto-populated from your business details
This page was generated by the MechaSite compliance baseline module. Review the controller details below for accuracy and update them in your Business Info admin if any field is incorrect.
Sub-processors
Last updated: 22 August 2026
This site is delivered by Mecha Site on behalf of Good Latch. Mecha Site engages the following sub-processors to operate the platform. Under UK GDPR Art. 28(2), Good Latch retains the right to object to any sub-processor for legitimate reasons.
Current sub-processors
| Name | Purpose | Location | Effective | Link |
|---|---|---|---|---|
| Cloudflare, Inc. | Content delivery network, DDoS protection, and DNS for the Mecha Site platform and the websites we manage. | Global edge network (data residency: UK/EU edges preferred) | 2026-01-01 | website |
| Cloudflare Email Routing (Cloudflare, Inc.) | Receives inbound email at the MechaSite sink subdomain (inbound.mechasite.com) on behalf of opted-in webmail customers, ARC-validates SPF/DKIM/DMARC, and posts the ephemeral RFC 822 bytes to our /api/webhooks/cf-email-inbound endpoint via an HMAC-signed Standard Webhooks request. The bytes are a NEW-MAIL ARRIVAL TRIGGER for the W-P2 IMAP fetch (the source of truth) plus an in-process content cache — Cloudflare does NOT persist the messages (per the Email Routing privacy guarantee: "we don't look into, queue, or store emails at any point"). Active only for mailboxes that have opted into the W-P5 "instant tier" copy-forward. | Global edge network (data residency: UK/EU edges preferred) | 2026-06-29 | website |
| Cloudflare R2 (Cloudflare, Inc.) | Object storage for site assets, generated artefacts, and DSAR export bundles. | EEA-resident buckets (jurisdictional hint enforced) | 2026-01-01 | website |
| GitHub, Inc. (Microsoft) | Source code repositories for client websites (deploy pipeline) and internal Mecha Site code. Engaged via GitHub App. | United States | 2026-02-01 | website |
| Anthropic, PBC | External AI sub-processor for the PRD Gap-Analysis pipeline (Claude API): classifies customer PRD requirements against the MechaSite module catalogue to identify capability gaps. Only the sanitised canonical PRD text + the curated module register reach the API (never raw attachment bytes, never internal architecture); model output is staged proposal-only until admin confirmation. Also the staged frontier rung for the My Mecha copilot (separate flag/ceremony). | United States | 2026-07-10 | website |
| Inngest, Inc. | Durable workflow orchestration for deployment pipelines, complaint deadline timers, and async jobs. | United States | 2026-02-15 | website |
| MXRoute (MXroute LLC) | Email hosting for client custom domains (managed website mailboxes). Currently testing on basic 10GB tier. | United States (data centre: Texas) | 2026-03-01 | website |
| Neon, Inc. | Managed PostgreSQL database for the Mecha Site platform (London region) and per-site DBs in deployment pipeline. | United Kingdom (eu-west-2 region) | 2026-01-01 | website |
| Openprovider (Hosting Concepts B.V.) | Domain registration on behalf of customers (DM-P3 BUY cycle). Reseller of the upstream ICANN-accredited registrar — passes customer registrant contact details (name, email, postal address, phone) to the relevant registry (Verisign for .com/.net, Nominet for .uk, EURid for .eu, etc.) at the moment of registration. | Netherlands (Rotterdam; KVK Chamber of Commerce 24277249) | 2026-05-15 | website |
| Render Services, Inc. | Application hosting (PaaS) for the Mecha Site platform and generated client websites. | United States | 2026-01-01 | website |
| Resend, Inc. | Transactional email delivery (welcome, password reset, security alerts, complaint acknowledgements, ops notifications). | United States | 2026-01-01 | website |
| Google LLC (PageSpeed Insights + Chrome UX Report APIs) | Free website audit only. We send the website address the prospect asked us to audit; Google fetches and measures that site itself. Acting as an INDEPENDENT CONTROLLER under its own terms, not as our processor. It receives the website address and nothing else — never a name, email address or message, and never any customer or site-visitor data. | United States | 2026-08-04 | website |
| Sentry (Functional Software, Inc.) | Error monitoring and (consent-gated) session replay recordings. | United States | 2026-01-01 | website |
| Statsig, Inc. | Feature flag evaluation and aggregate product analytics. Two-mode init (anonymous stableID on public routes; userID on authenticated routes) per consent. | United States | 2026-01-01 | website |
| Stripe Payments UK Ltd | Subscription billing, payment processing, customer object management, VAT handling. | United Kingdom (Stripe UK entity); fall-back EU/US for payment rails | 2026-01-01 | website |
| Upstash, Inc. | Serverless Redis for rate limiting, ephemeral cache, and Layer 1 edge throttling. | Global edge (EU primary region: eu-west-1) | 2026-01-01 | website |
Get notified of changes
Subscribe with your email to receive notification at least 30 calendar days before any sub-processor is added, modified, or removed. Notifications include a one-click unsubscribe link.
RSS feed
Prefer machine-readable updates? Subscribe to the RSS / Atom feed in your favourite reader.
Right to object
If you (or Good Latch) have a concern about a sub-processor, please contact Contact@goodlatch.com. We will work with the controller to resolve concerns or, where necessary, terminate the processor relationship.