HearthTrust
Subprocessor register
Every third party involved in delivering Hearth, what data it touches, and where. Customers get prior notice before this list changes, with the right to object on reasonable grounds. That commitment is written into our data processing agreement.
The one that matters most in this sector is the AI provider. It is the only subprocessor that can receive children’s record content, and only when a home switches AI features on. Our rule, stated publicly: AI stays off for real children’s records until the provider agreement and transfer safeguards are signed and shown here.
| Provider | Purpose | Data processed | Location | Safeguards |
|---|---|---|---|---|
| Supabase (database on AWS) | Hosting the production database and automated encrypted backups | All service data at rest, including children's records | London, UK (AWS eu-west-2) | Data stored in the UK. Provider data-processing terms incl. UK transfer safeguards cover any remote support access. |
| Vercel | Hosting the web application (served from London) and delivering the website | Data in transit through the application; no children's records at rest | Application functions: London, UK. Static site assets: global CDN. | Provider data-processing terms incl. the UK Addendum / SCCs. |
| Anthropic (Claude) AI features stay OFF for real children's records until this agreement is signed and confirmed here. | AI drafting (voice-to-log, weekly summaries, pattern-spotting) only when a home has enabled AI features | Record content submitted to those features, which can include children's data. Never used to train models. | United States / provider regions | UK Addendum / IDTA and a transfer risk assessment. |
| Stripe Listed ahead of billing go-live. | Subscription billing | Billing contact and payment details of the customer organisation only, never children's data | US / global | Stripe's data-processing terms incl. UK safeguards. |
What is deliberately not on this list
- No analytics or advertising providers. The site and app run no third-party trackers.
- No marketing platforms holding your service data. Demo enquiries stay on our own UK-hosted infrastructure.
- No offshore support tooling with standing access to records. Access to production data is restricted to Hearth itself and audited.
Change notice
Before adding or replacing a subprocessor we give customers written notice so they can object on reasonable grounds, as set out in the data processing agreement. Questions about this register: privacy@carehearth.co.uk.
Hearth is a trading name of Hearth Systems Ltd, registered in England and Wales (company no. 17349265). Registered office: 20 Turner Road, Bean, Kent, DA2 8BA. ICO registration: ZC205445.
Last updated: 5 July 2026.