Operational register
Sub-processors
- Last updated
- 27 August 2026
- Change notice
- At least 30 days
KAIRO uses the third-party services below to deliver the platform. Each is a “sub-processor” under UK GDPR Article 28: they process personal data on KAIRO’s behalf as part of providing their service to us. We have written data-processing agreements with each material sub-processor that bind them to UK GDPR-equivalent standards.
We will give you at least 30 days’ written notice before adding or replacing any sub-processor on this list. If you object to a change you may terminate your subscription with no early-cancellation fee within that notice period. Subscribe to changes by emailing admin@kairoengine.com.
Active sub-processors
| Provider | Purpose | Data processed | Region | Record |
|---|---|---|---|---|
| Supabase Inc. | Postgres database, authentication, storage | All operator + driver + client + job data | EU (Frankfurt) | Policy ↗ (opens in a new tab) |
| Vercel Inc. | Web hosting, edge network, serverless compute | Request logs, IP addresses (transient) | Global edge; primary US | Policy ↗ (opens in a new tab) |
| Stripe Payments Europe Ltd. | Subscription billing + tenant payment acceptance (Stripe Connect) | Operator billing details; passenger payment cards via tenant Connect accounts | EU (Ireland) + US | Policy ↗ (opens in a new tab) |
| Anthropic, PBC | AI model inference (dispatch suggestions, classification, drafting) | Job metadata, email/inbox content (when operator enables Gmail integration), redacted client identifiers | US | Policy ↗ (opens in a new tab) |
| Google Workspace (Google Ireland Ltd.) | Operator-controlled email + calendar OAuth | Email content + metadata, but only via OAuth tokens stored on the operator's account; KAIRO does not have organisational access | EU + US | Policy ↗ (opens in a new tab) |
| Resend, Inc. | Transactional email fallback (when operator hasn't connected Gmail / SMTP) | Recipient email, message content, delivery metadata | US (Amazon SES) | Policy ↗ (opens in a new tab) |
| Twilio Inc. | SMS dispatch + WhatsApp notifications + voice routing (when operator connects) | Recipient phone, message content, delivery status | US + EU | Policy ↗ (opens in a new tab) |
| Xero (UK) Ltd. | Accounting sync (when operator connects on Scale plan) | Invoices, expenses, contacts pushed via OAuth | UK | Policy ↗ (opens in a new tab) |
| DVLA (Driver and Vehicle Licensing Agency) | Vehicle registration enquiries | Vehicle registration plate (per lookup); no driver PII | UK | Policy ↗ (opens in a new tab) |
| AviationStack (apilayer GmbH) | Flight tracking + airport intelligence | Flight numbers (per lookup); no passenger PII | EU (Austria) | Policy ↗ (opens in a new tab) |
| Calendly LLC | Demo scheduling on the /demo page | Name, email address and the booked time slot | US | Policy ↗ (opens in a new tab) |
Supabase Inc.
- Purpose
- Postgres database, authentication, storage
- Data processed
- All operator + driver + client + job data
- Region
- EU (Frankfurt)
Vercel Inc.
- Purpose
- Web hosting, edge network, serverless compute
- Data processed
- Request logs, IP addresses (transient)
- Region
- Global edge; primary US
Stripe Payments Europe Ltd.
- Purpose
- Subscription billing + tenant payment acceptance (Stripe Connect)
- Data processed
- Operator billing details; passenger payment cards via tenant Connect accounts
- Region
- EU (Ireland) + US
Anthropic, PBC
- Purpose
- AI model inference (dispatch suggestions, classification, drafting)
- Data processed
- Job metadata, email/inbox content (when operator enables Gmail integration), redacted client identifiers
- Region
- US
Google Workspace (Google Ireland Ltd.)
- Purpose
- Operator-controlled email + calendar OAuth
- Data processed
- Email content + metadata, but only via OAuth tokens stored on the operator's account; KAIRO does not have organisational access
- Region
- EU + US
Resend, Inc.
- Purpose
- Transactional email fallback (when operator hasn't connected Gmail / SMTP)
- Data processed
- Recipient email, message content, delivery metadata
- Region
- US (Amazon SES)
Twilio Inc.
- Purpose
- SMS dispatch + WhatsApp notifications + voice routing (when operator connects)
- Data processed
- Recipient phone, message content, delivery status
- Region
- US + EU
Xero (UK) Ltd.
- Purpose
- Accounting sync (when operator connects on Scale plan)
- Data processed
- Invoices, expenses, contacts pushed via OAuth
- Region
- UK
DVLA (Driver and Vehicle Licensing Agency)
- Purpose
- Vehicle registration enquiries
- Data processed
- Vehicle registration plate (per lookup); no driver PII
- Region
- UK
AviationStack (apilayer GmbH)
- Purpose
- Flight tracking + airport intelligence
- Data processed
- Flight numbers (per lookup); no passenger PII
- Region
- EU (Austria)
Calendly LLC
- Purpose
- Demo scheduling on the /demo page
- Data processed
- Name, email address and the booked time slot
- Region
- US
International transfers
Where a sub-processor is located outside the UK or EEA (notably the US), data is transferred under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Each US-based provider listed has Data Privacy Framework (DPF) certification, an SCC-based DPA, or both.
Tenant-controlled processors
Where you (the operator) connect your own Google, Twilio, Xero or SMTP account to KAIRO, those services act under your account terms, not ours, and are not listed above. KAIRO holds the OAuth tokens or credentials securely in encrypted storage but does not contract with those providers on your behalf.
For our full Data Processing Agreement, see /legal/dpa. For our overall privacy practices, see /legal/privacy.