SUBPROCESSOR SCHEDULE
Service-provider register
Launch-review draft ยท 7 September 2026
Pre-launch notice: these documents remain subject to final solicitor review and public paid subscriptions are not yet open.
This pre-launch schedule distinguishes active sandbox or beta services from the providers selected for paid production. Final contracting entities, locations and transfer safeguards still require verification before paid launch.
| Provider | Status | Purpose | Launch action |
|---|---|---|---|
| OpenAI Sites platform and infrastructure providers | Current free beta/staging only | Temporary application hosting, database, object storage and operational logs | Must not host the paid production service; record final beta deletion/export plan |
| Cloudflare | Selected for paid production | Workers application hosting, D1 database, R2 object storage, Images and operational logs | Provision in the QuercusQuote-owned account with EU-jurisdiction D1/R2; verify contracts and transfer safeguards |
| Auth0 by Okta | Active in staging | Authentication, account recovery and MFA | Create a separate production application and verify contracting entity, processing region and transfer safeguards |
| Stripe and Onelink | Active in sandbox | Subscription checkout, billing records, fraud controls and merchant-of-record services where eligible | Keep live charging disabled until production hosting, tax and end-to-end checks pass |
| Microsoft 365 / Outlook | Active for business email | Support, privacy and service email | Confirm mailbox routing, retention, SPF, DKIM, DMARC and human ownership |
| Transactional email provider | Not yet selected | Application service messages that are not sent by Auth0, Stripe or Onelink | Select only if launch messaging requires it; document region, terms and transfer safeguards before use |
Changes
Material new subprocessors will be added to this schedule before they process Customer Data. Paid customers may object on reasonable data-protection grounds through the process in the DPA.
International transfers
Where a provider processes UK personal data without UK adequacy coverage, QuercusQuote will record the applicable UK IDTA, UK Addendum or other lawful mechanism and any supplementary measures. Equivalent transfer reviews will be recorded for Canada, Australia and New Zealand where required.