Home/Sub-processors
TrustSub-processors
The third parties that process data on our behalf, what each of them does, and where they do it.
Last reviewed August 2026
Quick answers
The questions we are asked first
Written so this section can be copied straight into a security questionnaire.
Why does this page exist?
Article 28 of the GDPR requires a controller to know who processes their data.
How will we hear about changes?
A notification list you can subscribe to, with notice before a new sub-processor starts.
Can we object to a new one?
Yes. The processing agreement sets out how and by when.
The current list
| Sub-processor | What it does | Location | Transfer basis |
|---|---|---|---|
| Cloud hosting | Hosting the application and stored files | To confirm | To confirm |
| Email delivery | Sending system messages to authors, reviewers and staff | To confirm | To confirm |
| Error monitoring | Detecting and diagnosing faults | To confirm | To confirm |
| Backup storage | Holding backups remote from the primary server | To confirm | To confirm |
What we do not do
- Integrations you choose to switch on are not sub-processors of ours. iThenticate, Prophy and the rest process data under your own agreement with them, and they are listed on the integrations page instead.
Get started
Tell us what you review.
We will show you the workflow.
Send us the outline of your process and we will build it in a session with you.