Sub-processors & Trust
Last updated: 9 April 2026
ICO Registration
SwiftSparrow Ltd (trading as Pillar & Post) is a registered data controller with the UK Information Commissioner's Office. Registration Number: CSN4633381. You can verify this registration on the ICO public register.
Our Sub-processors
To deliver our service, we share limited data with the following third-party providers. Each has been selected for security, reliability, and compliance with UK/EU data protection standards. All international transfers are made under Standard Contractual Clauses (SCCs) where required.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Neon | Primary database | All platform data including job listings, company profiles, and candidate CV files (held max 72 hours) | AWS Europe West 2 (London, UK) |
| Heroku (Salesforce) | Application hosting | System logs — no personally identifiable information stored in logs | AWS Europe West 1 (Dublin, EU) |
| Stripe | Payment processing | Billing and transaction records. Card details are never seen or stored by us — handled entirely by Stripe | Global / UK (PCI-DSS compliant) |
| Resend | Transactional email delivery | Names and email addresses used to deliver account and billing notifications | AWS US-East-1 |
| Cloudinary | Image storage and delivery | Logos and site images uploaded by customers. No candidate personal data. | Global CDN |
| Sentry | Error tracking and monitoring | Technical error logs for debugging. Configured to minimise PII capture. | AWS US-Central |
| Google Workspace | Business email | Inbound support and general enquiry emails sent to [email protected] | Global / EU (Google Cloud) |
Data Residency: All primary platform data — including candidate CVs, job listings, company profiles, and user accounts — is stored in the UK on our Neon database (AWS London). Candidate CVs are automatically and permanently deleted after 72 hours.
International Transfers: Where data is processed outside the UK or EU (Resend, Cloudinary, Sentry), transfers are made under Standard Contractual Clauses in accordance with UK GDPR. We review our sub-processor list annually.
Data Processing Addendum
A Data Processing Addendum (DPA) is available to customers on request. If you require a DPA for your own compliance purposes, please contact us at [email protected].
Questions? Contact [email protected]