Sub-processors

In plain English

• These are the companies we use to run Slurry that may handle personal data about our customers.
• Each one is bound by a contract with data protection terms equivalent to our Data Processing Addendum.
• We give 30 days' notice before adding or replacing one, and you can object.
• If you use your own model key, that provider works for you, not us, and is not on this list.

1. Current sub-processors

Sub-processor	Purpose	Data processed	Processing location	Transfer safeguard
Railway Corporation	Application hosting, databases, compute for Simulations, staging and production environments	All Service data, including account data, logs, Customer Content and Generated Data	United States and/or EU region selected for the deployment [confirm region]	UK IDTA or EU SCCs with UK Addendum [confirm]
Stripe Payments UK Ltd and Stripe, Inc.	Payment processing, subscription billing, invoicing, tax calculation (Stripe Tax), fraud prevention	Billing contact, billing address, VAT number, payment card data (held by Stripe), transaction history	United Kingdom, European Union and United States	UK Extension to EU-US Data Privacy Framework and/or SCCs with UK Addendum
Cloudflare, Inc.	DNS for slurry.io, content delivery, TLS termination, web application firewall, DDoS and bot protection	IP addresses, request metadata, request and response content in transit	Global edge network; core in the United States	UK Extension to EU-US Data Privacy Framework and/or SCCs with UK Addendum
Resend (Plus Five Five, Inc.)	Transactional email: sign-up verification, security alerts, billing receipts, abuse notices	Name, email address, email content	United States	SCCs with UK Addendum [confirm]
Anthropic PBC	Hosted language model for generating and mutating synthetic seed data, and for abuse classification	Prompts built from Customer Content (API specifications, seed instructions) and model outputs; not intended to contain personal data	United States	SCCs with UK Addendum under Anthropic's commercial Data Processing Addendum
OpenRouter, Inc.	Hosted language model routing for seed data generation where a non-Anthropic model is selected	Prompts built from Customer Content and model outputs; not intended to contain personal data	United States (and the underlying model provider's location)	SCCs with UK Addendum [confirm]; zero-data-retention providers only where available

Our Terms of Service and Acceptable Use Policy prohibit personal data in Customer Content and Generated Data. The data listed for the model providers is therefore expected to be synthetic, and our scanning is designed to stop personal data reaching them.

2. Not sub-processors

• Your own model provider. If you supply your own API key for a model provider, that provider processes data under your own agreement with it. It is your vendor, not our sub-processor.
• Destinations you configure. Webhook endpoints and other destinations you configure receive data because you instruct it; they are your systems or your vendors.

3. Changes and objections

3.1 We will give at least 30 days' notice before a new or replacement sub-processor starts processing customer personal data, by updating this page and emailing the account owner of each customer that has accepted our Data Processing Addendum. You can also subscribe to updates by emailing privacy@slurry.io.

3.2 You may object on reasonable data protection grounds by emailing privacy@slurry.io within that notice period. We will discuss your concerns in good faith. If we cannot resolve them, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused period, as set out in the Data Processing Addendum.

3.3 In an emergency (for example, to maintain security or availability) we may replace a sub-processor on shorter notice, and will notify you as soon as possible.

4. Change log

Date	Change
25 September 2026	Initial list published