Sub-processors & Data Residency
Version 1.2 · Effective date: 17 October 2026 · ProSurvey Apps Limited (company no. 17118570), registered in England and Wales. Registered office: Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole, BH16 6FA.
See also: Data Processing Agreement · Privacy Policy · Trust & Security Handbook
This register lists the third parties who process data on our behalf, where that data is held, and — for anything that leaves the UK — the transfer safeguard relied on.
Data residency
Our database (Firestore), file storage (Cloud Storage), server functions (Cloud Functions) and reporting warehouse (BigQuery) are in the Google Cloud London region (europe-west2). The database and storage locations were fixed when our project was created, and the functions region is set in our code. Firebase Authentication, Cloud Messaging, Analytics, Performance Monitoring and Crashlytics are global Google services and may process data outside the UK. Static assets (website, portal, app bundles) are code, not customer data, and are distributed via CDN.
Core sub-processors
| Sub-processor | Role | Location / residency |
|---|---|---|
| Google Cloud / Firebase | Core hosting, database, storage, authentication, serverless functions, BigQuery, app attestation, push notifications (Cloud Messaging) | Database, storage, functions and BigQuery: UK (europe-west2, London). Authentication and Cloud Messaging are global; push notification text can include a property address. Any transfer outside the UK is under Google's standard contractual clauses (or equivalent transfer mechanism) |
| Stripe | Card payments and invoicing | UK/EU and US-headquartered; card data is out of our scope entirely (Stripe is PCI-DSS certified). Any transfer outside the UK is under Stripe's standard contractual clauses (or equivalent transfer mechanism) |
| Cloudflare | CDN, DNS, WAF, Turnstile bot protection | Global CDN network, US-headquartered; any transfer outside the UK is under Cloudflare's standard contractual clauses (or equivalent transfer mechanism) |
| Google Workspace (SMTP) | Transactional / notification email, unless an organisation configures its own mail server | US-headquartered (Google LLC) / Ireland (Google Ireland Ltd); any transfer outside the UK is under Google's standard contractual clauses (or equivalent transfer mechanism) |
| Google Maps Platform (Geocoding, Places) | Map coordinates for a property when it is added, and address suggestions as you type (the address or partial address and postcode). Uses the organisation's own Google key if it has added one, otherwise ours | US-headquartered; any transfer outside the UK is under Google's standard contractual clauses (or equivalent transfer mechanism) |
| postcodes.io | Postcode lookup when a property is added (postcode only) | UK |
| Apple Push Notification service | Push notifications to iPhone and iPad, delivered through Firebase Cloud Messaging (notification text can include a property address) | US-headquartered; under Apple's own terms |
| Apple and Google sign-in | Signing in with an Apple or Google account, where offered (name, email address, account identifier) | US-headquartered; under each provider's own terms |
| EPC register (gov.uk) | Energy-performance lookups for a property (address and postcode, sent from our servers) | UK — a public register |
| Google (Gemini API) — public docs assistant only | Powers the public documentation assistant on our website: receives the question a visitor types (up to 300 characters) and public documentation passages; no Customer or Tenant Personal Data | US-headquartered |
Analytics, advertising and crash reporting
On the website and the portal these are set only if you accept the cookie banner; the mobile apps use analytics and crash reporting automatically — see the Cookie Notice.
| Provider | Purpose | Location |
|---|---|---|
| Meta (Meta Pixel) | Advertising and campaign measurement | Meta Platforms Ireland Ltd / Meta Platforms, Inc. (US-headquartered); transfer under Meta's standard contractual clauses |
| LinkedIn (Insight Tag) | Advertising and campaign measurement | LinkedIn Ireland Unlimited Company / LinkedIn Corporation (US-headquartered); transfer under LinkedIn's standard contractual clauses |
| OpenAI (Ads Measurement Pixel) | Measuring our adverts in ChatGPT (website only, with consent) | OpenAI (US-headquartered); transfer under OpenAI's standard contractual clauses |
| Google (Firebase Analytics / Google Analytics 4) | Website and portal usage analytics (with consent); mobile app product analytics (automatic) | Google Ireland Limited / Google LLC (US-headquartered); transfer under Google's standard contractual clauses |
| Google (Firebase Performance Monitoring) | Website and portal loading-speed / technical-performance measurement | Google Ireland Limited / Google LLC (US-headquartered); transfer under Google's standard contractual clauses |
| Google (Firebase Crashlytics) | Native crash reporting in the mobile apps only | Google Ireland Limited / Google LLC (US-headquartered); transfer under Google's standard contractual clauses |
Customer-keyed AI providers (the Controller's own choice, not ours)
If a customer enables advisory AI assistance on survey content, that processing runs on the customer's own AI provider account and API key — for example Anthropic, Azure OpenAI, OpenAI, Google, or a compatible endpoint the customer configures. That processing is governed by the customer's own agreement with the provider it chooses, not by any agreement of ours. We store the key server-side only, scope its use strictly to that customer, and fail closed when no key is configured. Some drafting features read finalised records and send tenant names; the Privacy Policy (clause 6.1) lists what each feature sends. This row is listed here for transparency only.
| Provider type | Purpose | Engaged when |
|---|---|---|
| AI provider (Anthropic / Azure OpenAI / OpenAI / Google / BYO endpoint) | Advisory survey-content drafting and photo analysis — advisory only, never enters the sealed evidence record automatically | The customer adds their own key in Settings → AI |
| Identity provider (Microsoft Entra ID) | Single sign-on for the customer's own staff | The customer connects SSO on an eligible plan |
Lookup services — address and location data
Some features call public data services. They receive a property's address, postcode or map position, never names or survey content. Calls made directly from a surveyor's device also reveal that device's network address.
| Service | What it is used for | What it receives |
|---|---|---|
| OpenStreetMap Nominatim | Finding a property on the map | The property address or postcode, or map coordinates |
| Open-Meteo | Weather history and condensation-risk context | The property address (to find it) or map coordinates |
| OpenWeatherMap | Current weather at the property | The postcode or part of the address, then map coordinates |
| RainViewer | Rain-radar map layer | Map tile coordinates |
| ISRIC SoilGrids | Soil and drainage context | Map coordinates |
| OpenStreetMap tiles | Maps in the app and in reports | Map tile coordinates |
| unpkg and cdnjs | Map marker images | The device's network address only |
| Ordnance Survey Places | Only if an organisation adds its own key: a single test lookup with a fixed postcode. Not currently used for address lookups | No Customer Data |
Changes and notification
We will give at least 30 days' prior notice of any intended addition or replacement of a sub-processor, by updating this page and, where you have subscribed, notifying your organisation administrators, giving you a reasonable opportunity to object on reasonable data-protection grounds (see the DPA, clause 5.3).
ProSurvey Apps Limited · registered in England and Wales, company number 17118570 · HousingSurvey Pro™.
Changelog
- v1.2 (17 October 2026) — Adds OpenAI (Ads Measurement Pixel), loaded on the website only with cookie consent.
- v1.1 (2 October 2026) — Names every lookup, notification and sign-in service already in use, and corrects data residency.
- v1.0 (14 July 2026) — First published.