Sub-processors · BRIDGE
Who we share data with.
Last updated: 2026-06-02
About this page
“BRIDGE” is a trading name and product of Arcane Automations Ltd, the data controller. To operate the platform, we engage a small number of trusted sub-processors who act on our written instructions. The full list is published below and is updated when we onboard, swap, or retire a vendor.
For the legal categorisation, lawful basis, retention, and international-transfer mechanism that applies to each, see our Privacy Policy. If you have a question about a specific sub-processor or wish to object to a transfer, contact support@bridgewire.co.uk.
Current sub-processors
| Vendor | Purpose | Region |
|---|---|---|
| Stripe Payments Europe Ltd / Stripe, Inc. | Card processing, Stripe Connect Express (mentor onboarding, KYC, payouts), Stripe Customer Balance (training-centre BACS funding), Stripe Issuing (BRIDGE virtual cards), webhook reconciliation. | Ireland · United States |
| Resend, Inc. | Transactional and marketing email delivery (account, vetting, payment receipts, support replies, outbound campaigns). | European Union |
| Twilio Ireland Ltd / Twilio Inc. | Outbound SMS for transactional notifications, sent only where the recipient has opted in. | Ireland · United States |
| MongoDB Ltd (Atlas) | Managed application database hosting. | EU-West-1, Dublin, Ireland |
| Railway Corp. | Application server hosting and CI deployment. | europe-west4, Amsterdam, Netherlands |
| Cloudflare, Inc. | DNS, edge protection, TLS termination. | Global edge network |
| Amazon Web Services EMEA SARL | Encrypted object storage (S3) for profile photos, qualification documents, and insurance / accreditation certificates. | EU-West, Republic of Ireland |
| PostHog, Inc. (EU Cloud) | Product analytics — pageviews, in-app events, and privacy-masked session replay (all text and inputs masked) used to understand and improve how the platform is used. Loaded only where the visitor has accepted analytics cookies; users are identified by an opaque account id and role only, never by name or email. | European Union (Frankfurt, Germany) |
| Google Ireland Ltd | “Sign in with Google” OAuth identity provider; Google shares email, name, and profile picture when this sign-in option is used. | Ireland · United States |
| Companies House (UK Government) | UK registered-company verification lookup; only the company number is sent. | United Kingdom |
| Postcodes.io / MySociety | UK postcode geocoding for distance-based mentor matching; only the postcode is sent. | United Kingdom |
| HM Revenue & Customs | Statutory annual platform-operator report under the Model Reporting Rules for Digital Platforms (DAC7 / MRDP). See Privacy Policy section 13. | United Kingdom |
Changes to this list
We will update this page when a sub-processor is added, removed, or replaced. Material changes will also be notified to active users by email at least 14 days before they take effect, except where an urgent security or legal reason requires a faster switch.