Sub-processors
Draft – business details in square brackets are still to be confirmed.
Last updated: 6 November 2026
These are the third parties that process personal data for Scrutti, including client data in the files advice firms upload. Each works under a written contract with data protection terms equivalent to our data processing agreement.
| Provider | What they do | Personal data | Where | Safeguard |
|---|---|---|---|---|
| Anthropic, PBC | AI model that reads the case documents and applies the rulebook to produce the suggested findings, grade and verdict. | Case documents and call or meeting transcripts uploaded for a check; the rulebook being applied. | United States | UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or the UK Extension to the EU–US Data Privacy Framework where the provider is certified). Inputs and outputs are not used to train models. |
| Speechmatics (Cantab Research Ltd) [confirm legal entity] | Transcribes call recordings uploaded for a check, using its Enhanced model with speaker labels, when the firm hasn't uploaded its own transcript. | Call recordings and the resulting transcripts. | European Union (Speechmatics EU region). UK-based company. | EU covered by UK adequacy regulations; Speechmatics' data processing agreement. Recordings are deleted from Speechmatics as soon as the transcript is returned (and in any case within 7 days), and are never used to train models. |
| Supabase, Inc. | Database, file storage and sign-in for the Scrutti app. | All account, case and check data, uploaded case files and audit logs. | European Economic Area (Ireland). Moving to the United Kingdom (London) before live client use. | EEA covered by UK adequacy regulations; Supabase's data processing agreement. |
| Lovable [confirm legal entity name] | Hosts and runs the Scrutti website and app, including the server functions that pass data between your browser, the database and the AI model. | Data in transit between your browser and Scrutti; technical logs. | [Confirm hosting region with Lovable] | [Confirm transfer mechanism] and Lovable's data processing agreement. |
Changes
We give subscribing firms at least 30 days' notice, by email and in the app, before adding or replacing a sub-processor, so they can object. To be told about changes, or to ask about any provider, email [privacy@your-domain].