Skip to main content
Legal

Sub-processors

Version 1.1 · Effective 18 October 2026 · IBIOS Limited (company number NI743167)

IBIOS Limited (company number NI743167) uses the providers below to run the IBIOS service. This list shows the providers in use on 18 October 2026. We only list a provider once it is actually in use. Some features described on this website are not yet switched on, for example Microsoft 365 and SMS, and payment links (Stripe or SumUp) are available but not yet in use. Their providers will be added here before first use.

We will update this page before we add or replace a sub-processor, and we will give customers at least 30 days' notice by email or in the app, so they can object (see our Data Processing Terms).

Hosting and infrastructure

  • Fasthosts Internet Ltd: production hosting for the IBIOS application, database and file storage. Location: United Kingdom. Transfer safeguard: none needed (UK).
  • Contabo GmbH: hosting for this website, our self-hosted website analytics, and our test (staging) system. The test system uses test data or data with personal details removed. Location: Germany (EU). Transfer safeguard: UK adequacy regulation for the EEA.
  • Cloudflare, Inc.: DNS, network delivery and security, and routing of some AI requests. Location: global network. Transfer safeguard: UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses in Cloudflare's data processing addendum as a fallback.

AI processing

  • Groq, Inc.: our main AI provider, used for text and document understanding, drafting assistance, and speech-to-text (Whisper). Location: United States. Transfer safeguard: EU Standard Contractual Clauses with the UK International Data Transfer Addendum, under Groq's customer data processing addendum, supported by our transfer risk assessment. Groq does not keep request data by default.
  • OpenAI, L.L.C.: backup AI provider, used only when the main provider is unavailable or for small, low-sensitivity tasks. Location: United States. Transfer safeguard: EU Standard Contractual Clauses with the UK International Data Transfer Addendum, under OpenAI's data processing addendum, supported by our transfer risk assessment. OpenAI does not train on API data by default.

Notifications and productivity

  • Sendinblue SAS (Brevo): sends IBIOS's own transactional emails for the waiting list (the confirmation email and notices to our directors). It receives the recipient's name and email address and the message content. Location: European Union (France and Belgium). Transfer safeguard: UK adequacy regulation for the EEA; Brevo's data processing agreement (Appendix 3 of its terms of use), with Standard Contractual Clauses for any onward transfer outside the EEA.
  • Google LLC (Firebase Cloud Messaging): delivers push notifications to the IBIOS mobile app. Notifications contain only short alert text. Location: global (Google). Transfer safeguard: UK Extension to the EU-US Data Privacy Framework.
  • Google LLC (Google Sheets): used only where a customer asks us to export reports to its own Google Sheets. Location: Google data centres (United States and other countries). Transfer safeguard: UK Extension to the EU-US Data Privacy Framework.

Services a customer chooses to connect

These services only receive data when a customer connects its own account to IBIOS and switches the connection on. The data is held under the customer's own agreement with that provider.

  • Intuit Inc. (QuickBooks Online): accounting. Customers, invoices, payments, credits and write-offs that the customer has chosen to sync. Transfer safeguard: UK Extension to the EU-US Data Privacy Framework.
  • Xero Limited: accounting. The same records as QuickBooks, where Xero is used instead. Transfer safeguard: UK Addendum in Xero's data processing terms.
  • HighLevel, Inc. (GoHighLevel): marketing CRM. Leads, appointments and call records. Transfer safeguard: UK Extension to the EU-US Data Privacy Framework, and the UK Addendum to the EU Standard Contractual Clauses.
  • Wix.com Ltd (Wix Bookings): online booking. Appointments and booking contact details. Transfer safeguard: UK adequacy regulation for Israel, with Standard Contractual Clauses for onward transfers.
  • ShopWired Ltd: web shop. Orders and order contact details. Location: United Kingdom.

Run on our own servers (not sub-processors)

These run on our own servers, so no third party processes the data: the PostgreSQL database, real-time voice (LiveKit), website analytics (Plausible) and the knowledge search index.

Questions

Email hello@allforone.ai.

Change history

  • 1.1, 18 October 2026: Added Brevo (Sendinblue SAS) for waiting-list emails.
  • 1.0, 16 October 2026: First published list, matching the providers configured in production on 16 October 2026.