/Legal
Last updated: 14 October 2026
out sauce and broch are trading names of WATTWAY LTD (company number 15205774). When we process personal data on behalf of a client under our Data Processing Agreement (DPA), we use the third-party sub-processors listed below. Each is engaged under a written contract containing data-protection terms at least as protective as those in our DPA, in line with UK GDPR Article 28.
This list covers work under either trading name. Where a sub-processor is used only for some engagements, the “used for” column says so.
We notify all clients with a signed DPA by email at least 30 days before adding or replacing a sub-processor, except where a change is needed urgently for security or legal reasons, when we give notice as soon as we reasonably can. This page is the authoritative current record. A client may object on reasonable data-protection grounds within 30 days of notice, as set out in clause 4 of our DPA.
To add further recipients for change notifications, or to raise an objection, contact legal@out-sauce.ai.
| Sub-processor | Activity | Used for | Location(s) of processing | Transfer mechanism |
|---|---|---|---|---|
| Supabase, Inc. | Database, authentication, and storage of client data | All engagements | United Kingdom (AWS eu-west-2) by default for new engagements; each client's region is stated in their agreement and may be the European Union (AWS eu-west-1) or the United States (AWS us-west-1) | No restricted transfer (UK and EU regions); UK IDTA / EU SCCs + UK Addendum where a US region applies |
| Anthropic, PBC | LLM inference (Claude models) | Client engagements where an AI feature is enabled | United States | UK IDTA / EU SCCs + UK Addendum |
| OpenAI | LLM inference (GPT models) for Brainwaves and answers over the client's marketing data, and text embeddings for the business brain's search across the documents the client uploads | broch engagements with Brainwaves or the business brain enabled, and the public broch demos | United States | UK IDTA / EU SCCs + UK Addendum |
| Slack Technologies, LLC (a Salesforce company) | Support messaging between our team and the client's team, in a shared channel per client | broch Premium engagements, from 13 November 2026 (notified 14 October 2026) | United States | UK IDTA / EU SCCs + UK Addendum |
| Vercel Inc. | Application hosting for client builds | Client builds hosted on Vercel | United States (compute and builds); global CDN edge network | UK IDTA / EU SCCs + UK Addendum |
| Railway Corp. | Application hosting and backend services for client builds | Client builds hosted on Railway | United States (US East, Virginia) | UK IDTA / EU SCCs + UK Addendum |
| Rented connector provider (marketing sources) | Reads client marketing-channel data (ad platforms, email) through a connector account we hold centrally, and writes it into the client's own Supabase project | broch engagements using the rented fast-start connector option for marketing sources | Outside the UK/EEA | UK IDTA / EU SCCs + UK Addendum |
| Rented connector provider (commerce and finance sources) | Reads client commerce and finance-system data through a connector account we hold centrally, and writes it into the client's own Supabase project | broch engagements using the rented fast-start connector option for commerce and finance sources | United States | UK IDTA / EU SCCs + UK Addendum |
| Resend | Delivers sign-in codes and service notification emails | Engagements whose dashboard or portal uses email sign-in or email notifications | United States | UK IDTA / EU SCCs + UK Addendum |
| Vetted individual contractors | Development, support and marketing services (including the expert bench, which works inside a client's broch) under written agreements containing UK GDPR Article 28 obligations | All engagements, as needed; the expert bench on broch Premium engagements that commission it | United Kingdom, or outside the UK/EEA where the contractor's agreement says so | No restricted transfer where UK-based; UK IDTA / EU SCCs + UK Addendum for any contractor outside the UK/EEA |
For each sub-processor we record: the entity name and country of establishment, the processing activity, the location(s) where personal data is processed, and the safeguard relied on for any restricted transfer.
Two things clients sometimes expect to see here, and why they are not:
Your own connected tools. Where a managed connector or data source runs in an account you own and you contract the provider directly, that provider is your processor, not our sub-processor. We only read what you grant us.
Our own website hosting and analytics. Vercel hosts out-sauce.ai and Railway hosts broch.ai; PostHog provides analytics on out-sauce.ai. These handle visitors to our own sites, not client data, so they belong in our privacy notice rather than on this list.