/Legal
Last updated: 31 August 2026
out sauce and broch are trading names of WATTWAY LTD (company number 15205774). When we process personal data on behalf of a client under our Data Processing Agreement (DPA), we use the third-party sub-processors listed below. Each is engaged under a written contract containing data-protection terms at least as protective as those in our DPA, in line with UK GDPR Article 28.
This list covers work under either trading name. Where a sub-processor is used only for some engagements, the “used for” column says so.
We notify all clients with a signed DPA by email at least 30 days before adding or replacing a sub-processor, except where a change is needed urgently for security or legal reasons, when we give notice as soon as we reasonably can. This page is the authoritative current record. A client may object on reasonable data-protection grounds within 30 days of notice, as set out in clause 4 of our DPA.
To add further recipients for change notifications, or to raise an objection, contactlegal@out-sauce.ai.
| Sub-processor | Activity | Used for | Location(s) of processing | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, and storage of client data | All engagements | United Kingdom (AWS eu-west-2) by default for new engagements; each client's region is stated in their agreement and may be the European Union (AWS eu-west-1) or the United States (AWS us-west-1) | No restricted transfer (UK and EU regions); UK IDTA / EU SCCs + UK Addendum where a US region applies |
| Anthropic, PBC | LLM inference (Claude models) | Client engagements where an AI feature is enabled | United States | UK IDTA / EU SCCs + UK Addendum |
| OpenAI | LLM inference (GPT models) | broch engagements with the brainwaves/ask dashboard feature enabled | United States | UK IDTA / EU SCCs + UK Addendum |
| Vercel Inc. | Application hosting for client builds | Client builds hosted on Vercel | United States (compute and builds); global CDN edge network | UK IDTA / EU SCCs + UK Addendum |
| Railway Corp. | Application hosting and backend services for client builds | Client builds hosted on Railway | United States (US East, Virginia) | UK IDTA / EU SCCs + UK Addendum |
| Rented connector provider (marketing sources) | Reads client marketing-channel data (ad platforms, email) through a connector account we hold centrally, and writes it into the client's own Supabase project | broch engagements using the rented fast-start connector option for marketing sources | Outside the UK/EEA | UK IDTA / EU SCCs + UK Addendum |
| Rented connector provider (commerce and finance sources) | Reads client commerce and finance-system data through a connector account we hold centrally, and writes it into the client's own Supabase project | broch engagements using the rented fast-start connector option for commerce and finance sources | United States | UK IDTA / EU SCCs + UK Addendum |
| Resend | Delivers dashboard sign-in codes by email | broch engagements using the central dashboard's email-code sign-in | United States | UK IDTA / EU SCCs + UK Addendum |
| Vetted individual contractors | Development and support services under written agreements containing UK GDPR Article 28 obligations | All engagements, as needed | United Kingdom | No restricted transfer (UK-based) |
For each sub-processor we record: the entity name and country of establishment, the processing activity, the location(s) where personal data is processed, and the safeguard relied on for any restricted transfer.
Two things clients sometimes expect to see here, and why they are not:
Your own connected tools. Where a managed connector or data source runs in an account you own and you contract the provider directly, that provider is your processor, not our sub-processor. We only read what you grant us.
Our own website hosting and analytics. Vercel hosts out-sauce.ai and Railway hosts broch.ai; PostHog provides analytics on out-sauce.ai. These handle visitors to our own sites, not client data, so they belong in ourprivacy noticerather than on this list.