Legal
Sub-processors
← All legal documentsCrestwell (the processor) engages the following sub-processors to deliver the service. Each processes broker-client personal data only as needed for its function. The last column says whether our data processing agreement with each one is in place; where it is not yet, the row says so.
| Sub-processor | Function in Crestwell | Data it touches | Processing location | DPA |
|---|---|---|---|---|
| Supabase | Primary database + file storage (clients, fact finds, documents, meetings, commission) | All stored client personal + financial data; uploaded documents; meeting audio (until deleted) | EU (Ireland, eu-west-1) | In place (Supabase DPA) |
| Anthropic | AI generation — document classification, fact-find extraction, suitability letters, file notes, Consumer-Duty prompts, protection-gap analysis, and matching the columns of a client-list import | The client's documents themselves (ID, payslips, bank statements, mortgage illustrations and the rest), sent whole for fact-find extraction and as a reduced copy for classification, usually the first page and the text of the others; meeting transcripts; fact-find content; the firm's own letter templates; and, when a firm imports a client list, its column headings and at most three example rows. Sent at generation time. Not used for training (Commercial Terms §B). Inputs and outputs are deleted within 30 days — save where a Usage Policy violation is involved, in which case up to 2 years, and 7 years for trust-and-safety classification scores. No zero data retention arrangement | US (Commercial API; EU SCCs with the UK Addendum in the Anthropic DPA) | In place (Anthropic Commercial DPA) |
| Deepgram | Speech-to-text transcription of meeting recordings | Meeting audio + resulting transcript | US (confirmed; model-training opt-out enforced per request; audio transient, not retained) | Not yet in place — requested |
| Inngest | Durable background jobs: meeting processing, upload receipts, calendar updates, billing emails, and the scheduled retention and health sweeps | Identifiers (a meeting, appointment, upload link, firm or billing reference) and job metadata only — not the audio, a transcript, a document, or a client's name or email address | US (region to be confirmed in the DPA) | Not yet in place — requested |
| Resend | Email, both ways. Sending: chase reminders, portal and signing links, signing codes, upload receipts, review requests, the post-meeting recap, the issued suitability letter, retention emails, team invites, and billing and security emails. Receiving: email sent to a client's or a firm's document intake address | Sending: the recipient's name and email address, the subject and the message. Some messages carry case content: the post-meeting recap summarises the meeting, the client's objectives and the documents still outstanding, and, where a firm has switched letter sending on, the finalised suitability letter goes to the client whole, as a PDF attachment. Receiving: the whole email as it was sent, including the sender, the recipients, the subject, the body and every attachment (usually ID, payslips or bank statements). Resend receives and stores the email, and Crestwell copies the attachments into the client's file. Mail Crestwell holds for an adviser to check has its attachments fetched from Resend only once the adviser accepts it, except an email forwarded inside it, which is fetched and opened in memory to decide whether to hold the message, and not kept | US — Plus Five Five, Inc. (checked 4 Sep 2026). A firm's own sending domain is created in EU (Ireland, eu-west-1); the mail is processed in the US | In place (Resend DPA) |
| Vercel | Application hosting + serverless compute + request logs | Request data / logs transiting the app | UK (London, lhr1) (confirmed) | In place (Vercel DPA) |
| CloudConvert (Lunaweb GmbH, Germany) | Word → PDF conversion of a firm's own letter templates | A firm's filled Word letter (suitability letter or file note), when an adviser downloads it as a PDF, and when an adviser previews a suitability letter in the firm's own Word template, which is the view a letter opens on when the firm has one (the preview is built once the adviser has confirmed the details it shows). Sent under the document type's name, never the client's; the conversion job is deleted as soon as the PDF is back, and CloudConvert otherwise deletes it within 24 hours | EU (Germany) — every conversion is sent to CloudConvert's Germany endpoint, whatever the account's own region setting | Not yet in place — being put in place |
| Backblaze (Backblaze, Inc.) | Off-site backup storage: one encrypted copy of the database and of every stored file, taken each night | An encrypted copy of all stored client personal and financial data and every uploaded document and meeting recording, except login details. It is encrypted before it leaves us, with a key only Crestwell holds, so Backblaze stores data it cannot read. Each copy is deleted after 5 days, and the deleted file is removed 1 day later, so data erased from Crestwell leaves these backups within 7 days | EU (Netherlands, Amsterdam: Backblaze's EU Central region). Backblaze is a US company | Not yet in place — being put in place |
| GitHub (GitHub, Inc.) | Runs the nightly backup job | While the job runs, each night for a few minutes: the same data as Backblaze, before it is encrypted. The machine and its copy are discarded when the job ends | Location not chosen by us: GitHub's hosted machines run in Microsoft Azure data centres, and the region is not selectable on our plan. GitHub is a US company | Not yet in place — being put in place |
Notes
- Audio minimisation: meeting audio is deleted after transcription by default (see the data retention and deletion policy), so Deepgram/Supabase hold audio only transiently. "Transiently" has two named bounds, both backstops rather than normal-path retention. Wherever processing runs, on success or failure, it deletes what it read at once, so neither bound is reached. The bounds cover what that delete never sees: a killed request, a request refused at intake, an upload never submitted, and a file sent to the wrong kind of job. For those, an hourly sweep removes anything in document storage (
extractions) older than 60 minutes and anything in audio storage (partner-audio: Partner API recordings, and any upload routed there) older than 4 hours, so normally within two and five hours of upload; a failed sweep alerts and the next run retries. - Inngest sees no content: only identifiers and job metadata cross Inngest, never the audio, a transcript, a document, or a client's name or email address. What a job reports back to Inngest when it finishes, which Inngest keeps with the job's history, is held to the same rule.
- Anthropic training: on the Commercial/API terms, submitted data is not used to train models.
- Backups: two sets. Supabase keeps 7 daily backups of the database inside its own service. Since 23 October 2026 we also keep an off-site copy of the database and of every stored file at Backblaze, encrypted before it leaves us with a key Backblaze never has, made by a job that runs on GitHub. Each off-site copy is deleted after 5 days and removed by Backblaze a day later, so erased data leaves both sets within 7 days. Login details are not in the off-site copy.
- Change management: the broker DPA commits Crestwell to telling controllers (broker firms) before a sub-processor is added or replaced.
Other recipients
Not sub-processors of client data in the sense above, but named here so nothing a firm's compliance officer could find in the code is missing from the register (added 5 Sep 2026 from the DPIA).
| Recipient | What it receives | On whose instruction | Location |
|---|---|---|---|
| The firm's own document store (Box, Google Drive, OneDrive or Dropbox) | The client's case file, filed into the firm's own account under client folders, when the firm connects one: the client's documents, the fact find once the adviser has certified it or the client has signed it, finalised suitability letters, the notes of reviewed meetings, and file check reports a broker has generated. A newer finished version replaces the copy filed before, and Crestwell moves its own earlier copy to the store's bin, as it does its copy of a document later moved to another client. One store at a time. Google Drive is reached with the drive.file scope, so Crestwell sees only the folders and files it creates |
The firm's; the store is the firm's own processor, not Crestwell's | Per the firm's own account with that store |
| Mortgage Broker Tools | Planned — no data flows to it until a route calls it. When live: mapped fact-find data (income, commitments, loan details) at the moment an adviser runs a lender affordability check | The adviser's, per check | UK |
| Public registers (postcode lookup, Companies House, the EPC register, Land Registry price-paid data) | A postcode, an address line or a company name only | Automatic enrichment of a client record | UK |
| Stripe | The firm owner's email and billing details. No client data | Crestwell, as controller for billing | US/EU under Stripe's DPA |
| Sentry (when enabled) | Error reports carrying record identifiers only; personal data is switched off (sendDefaultPii: false) |
Crestwell, for operations | US/EU under Sentry's DPA |
| Crisp (Crisp IM SARL, when the website ID is configured) | Website live chat: what a visitor types, the page they were on, and an email address if they leave one. Loads only when the visitor opens the chat, on the public website only — never inside the application, so no client file data. Added 16 Sep 2026; DPA and EU hosting to be confirmed at signup and the executed DPA filed with the others | Crestwell, as controller for website enquiries | EU (France) |
| The adviser's own calendar (Google Calendar or Microsoft Outlook) | For each appointment made in Crestwell: the appointment type, the client's initial and surname, the time, the location the adviser typed, and Crestwell's own reference for the entry. Never the notes, a link back to the case or the client's email address, and the client is never invited. Only once the adviser connects their own calendar; disconnecting stops it, and entries already written stay in that calendar | The adviser's; the calendar is the adviser's own account, not a Crestwell sub-processor | Per the adviser's own account with Google or Microsoft |
| The adviser's own mailbox (Gmail or Outlook) | Email the adviser writes or replies to from the Crestwell inbox, sent from their own address and kept by the mailbox's Sent folder; and, when the adviser opens a thread, the mark that it has been read. Nothing else is written into the mailbox: Crestwell never deletes, archives, moves or applies a label to anything in it, and the one label it changes is Gmail's unread mark, removed when the adviser opens a thread. In the other direction Crestwell reads the 50 most recent threads of the mailbox's Inbox and Sent folder while the adviser has the Crestwell inbox open, shows them to that adviser alone, and keeps none of it — no thread, message, address or attachment is stored by Crestwell, except an attachment the adviser files to a client they can act on, which from 25 Oct 2026 becomes a document in that client's file through the inbound-email lane (scanned, type-checked, read, stored under source = email; DPIA §2.1). What Crestwell keeps otherwise is the connection: the account's address, the permissions granted, encrypted tokens and whether the connection works. Only once the adviser connects their own mailbox; disconnecting stops it |
The adviser's; the mailbox is the adviser's own account, not a Crestwell sub-processor | Per the adviser's own account with Google or Microsoft |