Credbase
Start free
Subprocessors

Who we use to run Credbase

A short, current list of the third parties we rely on to deliver the service, what they process and where.

Credbase is operated by Aplera Labs Ltd (SC878012). To provide the service we use the subprocessors below. This page is part of our Data Processing Agreement and complements our Privacy Policy and Trust Centre.

We will update this page before adding or replacing a subprocessor and give you a reasonable opportunity to object on legitimate data-protection grounds. To be notified of changes, email hello@credbase.app.

Last updated: 13 July 2026

  • Purpose
    Application hosting, database, authentication, file storage and transactional email delivery.
    Data processed
    Account data, uploaded documents, workspace activity, notification emails.
    Location
    United Kingdom and European Union.
    Safeguards
    Managed EU/UK infrastructure. Contractual data-processing terms. Encrypted at rest and in transit.
  • Purpose
    Payment processing, invoicing and subscription billing.
    Data processed
    Billing contact, plan and payment metadata. Full card details are handled by Stripe, not stored by Credbase.
    Location
    Ireland with sub-processing globally.
    Safeguards
    Stripe is PCI DSS Level 1 certified. EU Standard Contractual Clauses with the UK Addendum for onward transfers.
  • Purpose
    AI-assisted document understanding: suggesting document type, expiry dates and category. Outputs are always suggestions and reviewed by a human on your team.
    Data processed
    Extracted text and metadata from documents you or your recipients upload. Not used to train foundation models.
    Location
    European Union and United States.
    Safeguards
    Accessed via Lovable AI Gateway under contractual no-training terms. EU Standard Contractual Clauses with the UK Addendum where transfers occur.
  • Purpose
    Aggregate search-performance analytics for the public marketing pages. No account or workspace data is shared.
    Data processed
    Anonymised page-level search metrics for credbase.app.
    Location
    Ireland.
    Safeguards
    Google Ireland is the controller of the underlying search data. Credbase only receives aggregate reports.
Requires review

Provider names, purposes and locations above reflect the current state of the platform. Exact contractual language for onward transfers and audit rights lives in our DPA. If your procurement team needs a signed subprocessor addendum on your own paper, email hello@credbase.app.