Subprocessors
Last updated 20 July 2026
To run FinStitch we rely on a small number of trusted service providers (subprocessors) that may process personal data on our behalf, under contract and only as needed. This page lists who they are, what they do, and the data they process.
1. Overview
FinStitch works with a limited number of trusted third-party service providers (“subprocessors”) to help deliver and support our Services. They process personal information on our behalf only where necessary, and only under appropriate contractual and data protection obligations. Before engaging any subprocessor, we assess its security, privacy, reliability and compliance practices.
2. Our subprocessors
| Provider | Purpose | Data processed | Processing location |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, storage, backups, encryption (AWS KMS), credential management (AWS Secrets Manager) and monitoring/logging (Amazon CloudWatch) | Account information, encrypted application data, logs, diagnostics | United Kingdom (London / eu-west-2) |
| Amazon Cognito (AWS) | Secure sign-in, identity management and multi-factor authentication | Name, email address, authentication identifiers, login activity | United Kingdom / AWS |
| Amazon SES (AWS) | Delivery of account-related and security emails | Email address, email content, delivery metadata | United Kingdom / AWS |
| RevenueCat | Subscription billing management for purchases made through the app stores | Subscription status, purchase and entitlement events, app-user identifiers | US, under appropriate safeguards |
| Stripe | Payment processing (only once paid web plans go live) | Billing and payment details, transaction metadata | EU / US, under appropriate safeguards |
| GitHub | Tracking of in-app feedback and feature requests submitted by users | Feedback text you choose to submit (we ask you not to include personal data) | US, under appropriate safeguards |
| Sentry | Error monitoring, diagnostics and service reliability | Device and browser information, technical diagnostics, usage metadata | Under appropriate safeguards |
| Regulated Open Banking provider(s) | Secure connectivity to eligible banks, with your consent | Account information, balances, transaction history, account identifiers | Varies by provider, under appropriate safeguards |
| Market-data & broker providers (e.g. Trading 212) | Prices and, where you connect them, your read-only holdings | Portfolio holdings, balances, investment account data | Varies by provider |
3. How we select subprocessors
We evaluate each subprocessor carefully before engaging them. Our assessment may consider:
- Security practices.
- Privacy standards.
- Reliability and operational resilience.
- Compliance with applicable data protection laws.
- Ability to protect customer information.
- Contractual commitments on confidentiality and data protection.
4. International transfers
Our primary infrastructure is in the UK. Where a subprocessor processes data outside the UK or EEA, we only use providers that offer appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the Standard Contractual Clauses.
5. Data protection obligations
All subprocessors are required to:
- Process personal information only on our documented instructions.
- Implement appropriate technical and organisational security measures.
- Maintain appropriate confidentiality obligations.
- Assist FinStitch in complying with applicable data protection laws where required.
- Notify FinStitch of security incidents affecting personal information without undue delay.
6. Changes
As FinStitch evolves, we may engage additional subprocessors or replace existing providers to improve our Services. When we make material changes to this list, we'll update the “last updated” date above. We encourage you to review this page periodically.
7. Contact
Questions about our subprocessors or how your data is processed? For privacy enquiries, email privacy@finstitch.com; for general help, support@finstitch.com. For more on how we handle your data, see our Privacy Policy.