01About this page
This page lists the third-party service providers BidHound engages to help us deliver the service (our “sub-processors”). It exists for two reasons:
- For our customers (where you have a Data Processing Addendum with us): so you can review who else may process personal data you entrust to us, and exercise the notification and objection rights set out in our Customer DPA clause 5.
- For data subjects more generally: so anyone can see the supply chain behind BidHound.
Our role and our sub-processors' roles are described in detail in the BidHound Privacy Notice and the Customer Data Processing Addendum (which forms part of your BidHound subscription contract).
02Current sub-processors
| Sub-processor | Service | Location of processing | Transfer mechanism (UK GDPR) | Certifications and notes |
|---|---|---|---|---|
| Anthropic, PBC trust.anthropic.com |
AI processing of redacted tender text via the Claude API (Messages API). | United States. | Anthropic commercial DPA, auto-incorporated into Anthropic's Commercial Terms of Service; incorporates EU Standard Contractual Clauses (Module 2, Controller-to-Processor) and the UK International Data Transfer Addendum (ICO IDTA, version laid before UK Parliament 2 February 2022). | SOC 2 Type II; ISO 27001:2022; ISO/IEC 42001:2023; HIPAA-ready. Anthropic does not train models on commercial API data. Default backend retention: up to 30 days for inputs and outputs (then automatically deleted), save for content flagged for safety/abuse review. Zero Data Retention is not available at BidHound's current usage scale; BidHound applies automated pre-transmission redaction (email addresses, phone numbers, postcodes, National Insurance numbers) to tender and profile content in its analysis pipeline, and the customer's company name is never included in analysis calls. |
| Hetzner Online GmbH hetzner.com |
Infrastructure hosting (VPS, network, storage) for the BidHound dashboard, database, and email-builder service. | Germany and Finland (Falkenstein and Helsinki data centres; the BidHound production VPS sits in the Helsinki, Finland facility). | UK to EEA transfer — adequacy decision applies; no additional safeguards required. | ISO 27001 (Hetzner Online GmbH); TÜV Rheinland Trusted Site Infrastructure attestation; Hetzner DPA accepted via customer portal. |
| AC PM, LLC / Wildbit, LLC (operators of Postmark) postmarkapp.com |
Transactional and digest email delivery (welcome emails, daily digests, account notifications). | United States. | Postmark commercial DPA incorporated in their Terms of Service; EU SCCs with the UK Addendum. | SOC 2 Type II; ISO 27001. Email contents include account email address, tender match list, and (for transactional flows) password-reset or account-status content. |
| Stripe Payments UK, Ltd. (with onward transfer to Stripe, Inc. and group entities) stripe.com |
Payment processing for BidHound subscriptions (Stripe Checkout, Stripe Customer Portal, recurring billing, webhooks). | UK contracting entity (Stripe Payments UK, Ltd.); onward transfer to US group entities for processing. | Stripe commercial DPA via account; EU SCCs with the UK Addendum for onward US transfer. | SOC 1 Type II; SOC 2 Type II; PCI DSS Service Provider Level 1; ISO 27001. Card data is collected by Stripe directly — BidHound does not see or store full card details. |
| Functional Software, Inc. (operators of Sentry) sentry.io |
Application error monitoring. When something breaks in the BidHound app, an automated error report is captured so we can diagnose and fix it. | Germany (EU data-residency region); US parent entity. | Sentry DPA incorporated in their Terms of Service; EU SCCs with the UK Addendum for any US access. | SOC 2 Type II; ISO 27001. Error events can include IP address, browser user agent, and the page or API route where the error occurred; they do not include passwords or payment data. |
| Resend, Inc. resend.com |
Internal operational alerting: automated system-health and monitoring emails sent to the BidHound operator only. Alert contents may include an account identifier (such as an email address or company name) when an alert concerns a specific account. Not used for customer-facing email. | United States. | Resend DPA (resend.com/legal/dpa); EU SCCs with the UK Addendum, incorporated by reference; Resend also states adherence to the EU-U.S. Data Privacy Framework and its UK Extension. | SOC 2 Type II (per Resend's published security documentation at resend.com/security). |
The authoritative current version of this list is the version published at bidhound.co.uk/legal/sub-processors. We will update this page when sub-processors change.
03Notification policy
When we add a new sub-processor, replace an existing one, or change the scope of what a sub-processor does for us:
- We update this page.
- Where you have a Customer DPA with us, we notify you by email at the address on your account at least 30 days before the change takes effect. This is the notification period set out in clause 5.3 of the Customer DPA.
If you object on reasonable data-protection grounds within that 30-day window and we cannot agree a resolution with you, you may terminate your subscription with effect from the date the change would otherwise have taken effect. The full mechanics are in the Customer DPA.
04Sub-processors of sub-processors (“onward sub-processors”)
Some of the providers above engage their own sub-processors (for example, infrastructure providers, deliverability monitoring, fraud-detection vendors). Each operates under its own published sub-processor list and DPA, and we hold each sub-processor responsible for binding any onward processors to equivalent data-protection terms. The published lists are:
- Anthropic: trust.anthropic.com
- Hetzner: published in the Hetzner DPA
- Postmark: published in the Postmark DPA
- Stripe: stripe.com/legal/dpa
- Resend: published in the Resend DPA
05Historical changes
| Date | Change | Notification sent? |
|---|---|---|
| 25 July 2026 | v0.4: added Resend (internal operational alerting to the BidHound operator; alerts may include an account identifier). | Listing correction — Resend was already in service for operator-only system alerts; added for completeness. No customer-facing processing added. |
| 24 July 2026 | v0.3: added Sentry (error monitoring, EU data residency); corrected Hetzner's location entry (Falkenstein, Germany and Helsinki, Finland); redaction note updated to describe the current redaction scope and the exclusion of customer company names from AI analysis calls; published the Customer DPA and linked it from this page. | Listing correction — Sentry was already in service and disclosed on our Security page; added here for completeness. No new sub-processor engaged. |
| 14 May 2026 | Initial publication of this page (v0.2 pre-solicitor review). | n/a (first version) |
06Contact
Questions about this page, our sub-processors, or our supply chain: legal@bidhound.co.uk.
Our Privacy Policy describes what personal data we collect and how we use it. Our Terms of Service set out the legal agreement between you and BidHound.