Sub-processors

VexLedger uses the companies below to provide the service. They process customer data only on our instructions and under written terms that protect it. This is the list our data processing addendum refers to.

Sub-processors

Company	What it does for VexLedger	Where	Customer data involved
Cloudflare	Hosts VexLedger, stores customer data and uploaded files, delivers the website, and protects the service and its forms from attack and abuse	Accounting records and uploaded files: the European Union. Application code: the European Union. Website files and network entry: Cloudflare’s global network (see below)	All customer data
Amazon Web Services	Delivers the emails VexLedger sends, including invitations, password resets, security notices and invoices sent on the customer’s instructions	United Kingdom (London)	Recipient names and email addresses, and the content of the email
Anthropic	Reads the content of documents such as receipts when a customer uses that feature, and returns the details it finds	United States	Only the documents the customer chooses to have read

Where data is stored and processed

• Accounting records and uploaded files are stored in the European Union. The database that holds a customer’s accounting records, and the storage that holds uploaded files such as receipts, are kept in Cloudflare’s EU jurisdiction.
• The application runs in the European Union. The code that processes accounting data runs in an EU region, next to the database.
• The website is delivered from the edge. Cloudflare serves the public website’s files from its global network, close to the visitor, and connections reach VexLedger through that network before being passed to the EU.

Services a customer connects

A customer can choose to connect services such as Stripe, GoCardless, a bank-data provider for bank feeds, HMRC and Companies House. When it does, VexLedger exchanges information with them on the customer’s instructions. These are the customer’s own providers or independent organisations, not VexLedger’s sub-processors, and each has its own privacy notice.

Changes to this list

We will give customers at least 30 days’ notice before a new sub-processor starts processing customer data, by email to the organisation’s owners and by updating this page. A customer may object within 14 days on reasonable data protection grounds, as set out in section 5 of the data processing addendum.

Last changed: 11 November 2026 (first publication).