Sub-processors & Trust
Last updated: 9 April 2026
ICO Registration
SwiftSparrow Ltd (trading as Pillar & Post) is registered with the Information Commissioner's Office, the UK's data protection regulator. Registration Number: CSN4633381.
Our Sub-processors
To deliver our service, we share limited data with the following third-party providers. Each has been selected for security, reliability, and compliance with UK/EU data protection standards. All international transfers are made under Standard Contractual Clauses (SCCs) where required.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Neon | Primary database | All platform data including job listings, company profiles, and candidate CV files (held max 72 hours) | AWS Europe West 2 (London, UK) |
| Heroku (Salesforce) | Application hosting | Application and request logs. Request logs record the visitor’s IP address, and application logs may record the account email address involved in an operation. Candidate CVs, application content and enquiry content are never written to logs. | AWS Europe West 1 (Dublin, EU) |
| Cloudflare | DNS, TLS termination, CDN and bot protection | All traffic to the marketing site and to customer custom domains passes through Cloudflare’s network. Visitor IP addresses are processed for bot verification (Turnstile) and abuse prevention. | Global CDN |
| Stripe | Payment processing | Billing and transaction records. Card details are never seen or stored by us — handled entirely by Stripe | Global / UK (PCI-DSS compliant) |
| Resend | Transactional email delivery | Names and email addresses used to deliver account and billing notifications | AWS US-East-1 |
| Cloudinary | Image storage and delivery | Logos and site images uploaded by customers. No candidate personal data. | Global CDN |
| Sentry | Error tracking and monitoring | Technical error logs for debugging. Configured to minimise PII capture. | AWS US-Central |
| Anthropic | AI writing help in the signup wizard and the site editor | Only the text a customer asks the writing helper to work on: the company name, the page name, the description or points they type in, and, when they ask for a page to be reworked, that page’s saved text. It is sent only to produce the draft that was requested. The helper does not read candidate records, job applications or contact enquiries, and customers are asked to remove personal details from the text before requesting a draft. Under Anthropic’s commercial terms, inputs and outputs are normally deleted within 30 days, with limited exceptions, and are not used for model training unless the customer opts in. | United States |
| Google Workspace | Business email | Inbound support and general enquiry emails sent to hello@pillarpostweb.com | Global / EU (Google Cloud) |
Data Residency: All primary platform data — including candidate CVs, job listings, company profiles, and user accounts — is stored in the UK on our Neon database (AWS London). Candidate CVs are automatically and permanently deleted after 72 hours.
International Transfers: Where data is processed outside the UK or EU (Resend, Cloudinary, Sentry, Cloudflare, Anthropic), transfers are made under Standard Contractual Clauses in accordance with UK GDPR. We review our sub-processor list annually.
Data Processing Addendum
A Data Processing Addendum (DPA) is available to customers on request. If you require a DPA for your own compliance purposes, please contact us at hello@pillarpostweb.com.
Questions? Contact hello@pillarpostweb.com