Subprocessors
Current at 12 October 2026. We tell customers before adding or replacing a subprocessor (data processing agreement).
Get My Books Ltd uses these providers to run GetMy Books. We give 30 days' notice by email before adding or replacing one (data processing agreement, clause 5).
| Provider | What it does for us | Data it receives | Location |
|---|---|---|---|
| Cloudflare, Inc. | Tunnel and access control in front of the server; the docs site; sign-in, by the Microsoft or Google account you choose or by a one-time code it emails to you (ADR 0038); off-site storage of the encrypted nightly backups (R2, EU) | All traffic to mcp.getmy.group, which it terminates TLS for; your email address, the one-time PIN emails it sends, sign-in identity and access logs |
Global network. Transfers under the UK Addendum to the EU standard contractual clauses and the UK–US data bridge (Data Privacy Framework) |
| Doppler, Inc. | Stores our system secrets (database passwords, the token encryption key, API keys) | Secrets only; no customer books data | United States, under the UK Addendum to the EU Standard Contractual Clauses in Doppler's data processing addendum |
| ntfy (ntfy.sh) | Push alerts to our own staff when the pipeline or server fails | Short operational messages (job name, commit); no customer data | Not published by the provider; only operational messages with no customer or personal data are sent |
| FEAW Services Ltd (company 10345690) (NAS host) | Hosts the production server and its database on its NAS, on FEAW's premises in the UK, until hosting moves to a cloud provider; its director has administrator (sudo) access to that machine | Everything the server and database hold, including the encrypted Xero tokens and the environment that holds the token encryption key | United Kingdom (FEAW premises) |
| Microsoft (Entra ID) | Sign-in with multi-factor authentication for Get My Books Ltd's own operators. (A customer who chooses "Continue with Microsoft" signs in to their own Microsoft account: see below.) | Operators' emails and sign-in events; no customer data | European Union (the getmy.group tenant's region) |
Independent controllers
Stripe Payments Europe, Ltd. / Stripe, Inc. takes the subscription payment (£19.99 per company per month; ADR 0037): your billing email, card and payment details, and an internal id for each company you subscribe for. Stripe is an independent controller for payment data, not our subprocessor. It decides how to use that data under its own privacy notice. We keep only the Stripe customer and subscription ids.
Services you connect, which are not our subprocessors
These are services you choose and have your own agreement with. GetMy Books connects to them on your instructions.
| Service | Why it is not our subprocessor |
|---|---|
| Xero | Your ledger. You connect it under Xero's terms; GetMy Books is a connected app reading and writing your organisation on your approval |
| Anthropic (Claude) | You use GetMy Books from your own Claude account. What GetMy Books returns goes into your conversation, which Anthropic handles under your agreement with Anthropic. We do not send your data to Anthropic or have a contract with it for your data |
| Companies House | A public register. GetMy Books looks up public company data by company number with our API key; it receives no customer books data |
| Your Microsoft or Google account | If you choose "Continue with Microsoft" or "Continue with Google", you sign in to your own account under its provider's terms, and the provider tells Cloudflare Access your email address and name. Nothing else is shared, and GetMy Books never sees your password |
| Your bank | GetMy Books never connects to it. You download statement files yourself (ADR 0035) |
Hosting
Today the server and its database run on a NAS owned and operated by FEAW Services Ltd (company 10345690), on its premises in the UK, reached only through the Cloudflare tunnel. The nightly backups are kept on the same NAS for 14 days, and an encrypted copy of each (AES-256, the key held outside Cloudflare) is stored in Cloudflare R2 in the EU for 35 days. That makes FEAW Services Ltd our subprocessor (listed above), under a written hosting and sub-processing agreement with Get My Books Ltd (feaw-hosting-agreement).