What is a sub-processor?
A sub-processor is a third party we engage to process customer personal data on our behalf in order to deliver V5 Ultimate. We remain responsible to the customer for any sub-processor's performance under the applicable V5 Commercial Terms for Software and Services (or, for earlier Orders, the Master Services Agreement) and DPA, or the Trial and Evaluation Terms for evaluation use.
"Hosting" means the provider hosts the V5 Ultimate cloud service. "Feature-specific" means the provider is used only where that feature or purchase route applies. "Optional" means the provider is only engaged when the customer enables the relevant feature.
1. Hosting — V5 Ultimate cloud service
The V5 Ultimate application runs on Google Cloud Run. Its database, sign-in and file storage are hosted by Supabase on Amazon Web Services, and independent backup and archive copies are kept in Google Cloud Storage. Source code is managed in GitHub. How these layers are used for backup and recovery is summarised in the Security & Trust reference. V5 Ultimate Private Cloud uses the same Provider-hosted infrastructure with an isolated application and database, as described in the V5 Commercial Terms for Software and Services.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase, Inc. | Hosting of the V5 Ultimate cloud service: managed Postgres database, authentication, file storage and backend services. | Customer application data at rest — tenants, batches, records, signatures, uploaded files, audit trail. | United States — Oregon (Supabase runs on Amazon Web Services). |
| Google LLC — Google Cloud | Runs the V5 Ultimate application (Google Cloud Run) and stores independent backup and archive copies (Google Cloud Storage). | Customer application data processed by the running application, and backup/archive copies of the database and files. | United States — application in Oregon and Iowa; backup and archive copies in a US multi-region location. |
2. Feature-specific — AI features, email and online checkout
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Lovable (Lovable Labs Inc.) — AI gateway and email delivery | AI request routing and transactional/authentication email delivery, where these services are used. Not the hosting provider for V5 Ultimate. | AI prompt inputs for AI features that are used; recipient email addresses and template content for transactional/authentication mail. | United States / global. |
| OpenAI, L.L.C. | AI processing using GPT models for V5 AI features that are enabled and used. The model used can vary by feature or task. | Prompts and the text, documents, images or other customer content submitted to those AI features, as needed to perform them. | United States / global. |
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Paddle.com Market Limited | Merchant of Record for purchases made through online checkout — payment processing, tax, invoicing, dunning and refunds for those purchases. Signed agreements invoiced directly by SG Systems Global do not go through Paddle. SG Systems Global never sees or stores card data. | Billing email, billing address, VAT / tax ID, subscription state. Card data is held by Paddle and its PCI sub-processors. | Global (Paddle infrastructure). |
Development and deployment services
GitHub, Inc. — stores the V5 Ultimate source code and runs our build and deployment workflow. GitHub is a development tool; it is not where the cloud service or tenant data is hosted, and it is not listed as a customer-data sub-processor on the basis of holding our source code.
3. Optional — only when the customer enables the feature
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Twilio Inc. | SMS reminders for kiosk sign-off and training expiry. Off by default — activated only when the customer configures Twilio credentials in Settings → Integrations. | Operator phone number and short notification text. | United States / European Union. |
4. Previously listed — no longer used
For transparency, the following are not sub-processors of V5 Ultimate and have been removed from this page:
- Amazon Web Services (AWS) — V5 Ultimate does not contract with AWS directly. AWS is the upstream infrastructure operated by Supabase (see §1).
- Lovable as hosting provider — As of September 28, 2026, V5 Ultimate is no longer hosted or deployed through Lovable; see §1. Lovable remains listed in §2 only for the AI gateway and email functions described there.
- Stripe, Inc. — Stripe is not used. Signed agreements are invoiced directly; some smaller online purchases use Paddle as Merchant of Record.
- Anthropic, PBC — Not used.
- Google LLC — Gemini models — No longer used for V5 AI features. V5 AI features use OpenAI GPT models (see §2).
- Sentry — Not configured in production.
- Google reCAPTCHA — Not used on any form.
On-premises deployments
Customers running V5 Ultimate on their own infrastructure (including a cloud account they control, which is an On-Premises deployment, not V5 Ultimate Private Cloud) do not use the cloud hosting sub-processors above for tenant data — the data stays inside the customer's environment. Email, payments, and AI sub-processors still apply where the customer chooses to use those features.
International transfers
Where sub-processors are located outside the customer's region, transfers are protected by the European Commission's Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, and — where applicable — the EU–US Data Privacy Framework. A transfer impact assessment is available on request.
Changes to this list
We will update this page before adding a new sub-processor that affects customer application data. Customers on a written contract that includes a sub-processor notification clause will additionally be notified by email at least 30 days before a new sub-processor begins processing their data, providing a reasonable opportunity to object.
Subscribe to updates
To receive email notifications when this page changes, use our .
See also our Privacy Notice, Trial and Evaluation Terms, Imprint, and Accessibility Statement.