Legal
Sub-processors
When your organisation uses TestOrchestrator, your organisation is the controller of the data in its workspace and Test Orchestrator Ltd is its processor. A sub-processor is a company we engage to process that data on our behalf, for example to host it or to send email. This page lists them, as Article 28 of the UK GDPR and the EU GDPR requires.
Read this page with our Privacy Policy. A data processing agreement (DPA) is available on request from support@testorchestrator.com.
Current sub-processors
Each company is named with the legal entity that holds the relevant certification. “EU-US DPF + UK Extension” means the company is an active participant in the EU-U.S. Data Privacy Framework and its UK Extension, as listed on dataprivacyframework.gov when we checked on October 26, 2026.
| Sub-processor | Purpose | Data categories | Location | Transfer safeguard | Their terms |
|---|---|---|---|---|---|
| Railway (Railway Corporation) |
Runs our backend application (API servers) | All workspace and account data while our API processes it | Netherlands (europe-west4). US company. | UK adequacy regulations for the EEA. EU-US DPF + UK Extension for any access from the US. | Railway DPA |
| Neon (Neon, LLC, part of Databricks, Inc.) |
Primary database (PostgreSQL) | All workspace and account data at rest | United Kingdom (London, aws-eu-west-2). US company. | Stored in the UK. EU-US DPF + UK Extension (Databricks, Inc., covering Neon, LLC) for any access from the US. | Neon DPA |
| Amazon Web Services (Amazon Web Services, Inc.) |
Attachment storage (S3) and transactional email (SES) | Files you attach; email addresses and the content of the emails we send, such as sign-in codes and invitations | United Kingdom (London, eu-west-2). US company. | Stored in the UK. EU-US DPF + UK Extension (Amazon.com, Inc., covering Amazon Web Services, Inc.) for any access from the US. | AWS GDPR Center and DPA |
| Vercel (Vercel Inc.) |
Hosts our web application and website, and delivers them through its content delivery network | Request metadata: IP address, browser user agent and the pages requested, plus a theme-preference cookie. Sign-in cookies go to our API host, not to Vercel | Global edge network. US company. | EU-US DPF + UK Extension. | Vercel DPA |
| Stripe (Stripe, LLC) |
Subscription billing, payments and tax calculation | Billing contact name and email, billing address, tax ID, invoices and payment records. Card details are entered on Stripe’s own checkout page and never reach us. | United States | EU-US DPF + UK Extension. | Stripe DPA |
| Anthropic (Anthropic, PBC) |
AI features such as test case generation. Used only for workspaces where an admin has turned AI on. | The text and test content a user selects for an AI request, and the generated result | United States | Not listed on the Data Privacy Framework. EU Standard Contractual Clauses (Module Two) with the UK International Data Transfer Addendum, in Anthropic’s DPA. | Anthropic DPA |
| Sentry (Functional Software, Inc.) |
Backend error monitoring | Error reports: request IDs, hashed identifiers and stack traces | EU data region (Frankfurt, Germany). US company. | UK adequacy regulations for the EEA. EU-US DPF + UK Extension for any access from the US. | Sentry DPA |
| Grafana Cloud (Raintank, Inc., trading as Grafana Labs) |
Service metrics | Aggregate operational metrics only. No workspace content. | United Kingdom (London, prod-gb-south-1). US company. | Stored in the UK. EU-US DPF + UK Extension for any access from the US. | Grafana Labs DPA |
| Zoho Mail (Zoho Corporation) |
Our support mailbox, support@testorchestrator.com | Support correspondence: your name, email address and what you send us | EU (Zoho Corporation, EU data centre) | UK adequacy regulations for the EEA. | Zoho GDPR page |
Website vendors
This company receives data from visitors to our public website, not from workspaces.
| Vendor | Purpose | Data categories | Location | Transfer safeguard | Their terms |
|---|---|---|---|---|---|
| Termly (Termly Inc.) |
Displays our Terms of Service on /terms | Visitors’ IP address and browser user agent when that page loads | United States | EU-US DPF + UK Extension. | Termly privacy policy |
Customer-authorised integrations are not sub-processors
Linear, GitHub, Jira, Notion and Azure DevOps are not our sub-processors: your workspace connects them itself, chooses what to share and can disconnect them at any time, so data sent to them is covered by your own agreement with that provider.
How changes are announced
Before we add a new sub-processor, we update this page and email every workspace admin at least 30 days before the new sub-processor starts processing workspace data. To object, reply to that email or write to support@testorchestrator.com within those 30 days. When we stop using a sub-processor, we remove it from this page and record the change in the changelog below.
Changelog
- : page first published, listing the nine sub-processors and one website vendor above.