This page lists, in one place, the companies that handle personal data for SponsorFlow. It repeats Section 7 of the Data Processing Agreement v1.5 and the sub-processor sections of the two SponsorFlow schedules (the Appendix D evidence-pack schedule, S5, and the pre-hire candidate upload schedule, P5). Where this page and those documents differ on a contractual point, those documents govern.
1. Who does what
When you use SponsorFlow, you (the employer or the law firm) are the controller of the personal data you put in. Friam Limited is your processor. A sub-processor is a company we use to process that data for you. Each one works only on our instructions, under data-protection terms no less protective than our Data Processing Agreement.
2. Sub-processors that handle your data
| Sub-processor | What it does for SponsorFlow | Data it handles | Where | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services | Runs SponsorFlow: the servers, the database, and file storage (encrypted at rest). Reads the text of scanned documents and photos, including identity documents (Amazon Textract). | Everything in SponsorFlow: account details, case and candidate records, uploaded documents and their images, extracted text and fields, evidence packs, and the activity log. | UK (London, eu-west-2) | None needed. Everything we run on AWS (servers, database, job queue, file storage and Textract) is in the London region, so the data stays in the UK. |
| Anthropic | AI that reads documents: it sorts pages by document type, reads named fields, gives a second reading of scanned pages, splits a candidate pack into people, and reads a job description. It also answers the in-app help chat. Our AI page explains what it sees and does. | The text of the document being read. For reading fields, the uploaded file itself (a PDF or photo), which can show a passport photo page. What you type into the help chat. | United States, as Section 7.1 of the Data Processing Agreement states | Transfers are covered by the EU Standard Contractual Clauses (Modules Two and Three) with the UK International Data Transfer Addendum, as incorporated in Anthropic’s Data Processing Addendum (effective 24 February 2025). Under that addendum Anthropic processes the data only to provide or maintain its services, deletes it within 30 days of the end of the agreement (subject to legal, dispute and abuse-prevention exceptions), gives notice of any new sub-processor with 15 days to object, and is audited annually (SOC 2 reports at trust.anthropic.com). Anthropic’s Commercial Terms (effective 17 June 2025, section B) state that it “may not train models on Customer Content from Services”. Friam’s agreement with Anthropic is available to the controller on request under Section 6.8 of the Data Processing Agreement. Anthropic’s own sub-processors are listed at anthropic.com/subprocessors. |
| Twilio | Sends text messages: sign-in codes, document request links, their reminders and access codes, and candidate upload links. Places one kind of voice call: when a law firm’s identity is checked against its entry on the SRA register, an automated call reads a 6-digit code to the firm’s listed number. | The name and phone number of the person messaged, and the message. For the call: the name of the person signing up, the domain of their email address, the firm’s name and the code. | Ireland (Twilio’s ie1 region). Twilio may process some data in the United States. | For Ireland, the UK’s adequacy finding for the EU. Any transfer to the United States is covered by Twilio’s Data Protection Addendum (last updated 9 April 2026): the UK Extension to the EU-US Data Privacy Framework and the UK International Data Transfer Agreement. |
| Resend | Sends email: sign-in links, team invitations, document request links and their reminders, and service notices. | The name and email address of the person emailed, and the message. | United States. Resend’s Data Processing Agreement (updated 31 December 2025) says its primary processing takes place in the United States. | The EU Standard Contractual Clauses with the UK Addendum, as incorporated in Resend’s Data Processing Agreement (sections 6.2 and 6.4). |
3. Services we use for our own records
For these, Friam is the controller, not your processor. No candidate or worker document is sent to them.
- Stripe Payments UK Ltd takes subscription payments. You enter card details on Stripe’s own checkout page; SponsorFlow does not receive them. Stripe holds your billing contact and payment details. UK / EU.
- Companies House (GOV.UK). We look up public register details about sponsor companies. Only a company name or number is sent. UK.
- rdap.org. When a law firm signs up, we check the age of its web domain as part of checking its SRA register entry. Only the domain name is sent.
4. Services you choose to connect
Clio. A law firm can connect its own Clio account. If it does, SponsorFlow files documents into the firm’s Clio matter when the firm asks it to. Clio is the firm’s own supplier, under the firm’s own agreement with Clio, so it is not our sub-processor.
5. Your browser
sponsorflow.uk, the SponsorFlow app and this page load their fonts from Google Fonts. Your browser then sends Google its internet address and browser details. No SponsorFlow data is sent.
6. What we do not use
- No advertising or third-party analytics on SponsorFlow pages. We count page visits ourselves.
- No other AI provider, and no automatic switch to a different AI model.
- No AI voice agent. The only call SponsorFlow places is the automated code call in section 2.
7. Changes to this list
Before we add or replace a sub-processor, we will tell you, and you can object on reasonable data-protection grounds, as Section 6.4 of the Data Processing Agreement says. We will update this page and its date when the list changes.
8. Contact
Questions about this list: legal@everyguard.uk.