Virtum

Legal

Sub-processors

The third parties that process personal data on Virtum's behalf, including customer data in the platform, what each does and where. Last updated 25 October 2026.

Where your data is

The Virtum platform, its databases and its backups are hosted on servers Virtum operates in the UK. Virtum's AI features run on models hosted on hardware Virtum operates in the UK, so no AI provider is a sub-processor.

Current sub-processors

Sub-processorWhat it doesWhere
Amazon Web Services (AWS)Delivers the website and platform through its content delivery network (Amazon CloudFront) and filters attacks with a web application firewall (AWS WAF) before traffic reaches our servers; runs the network edge server that passes that traffic on to our servers (Amazon EC2); and sends our service emails, such as sign-in, password reset, invitation and notification emails (Amazon SES). It also stores an encrypted copy of our backups.The edge server and email sending are in AWS's London region. CloudFront and AWS WAF run on AWS's global edge network, so a request may be handled at an AWS location outside the UK, usually the one nearest the person making it.
TailscaleProvides the encrypted network connection between the AWS edge and our servers in the UK. Traffic is encrypted end to end, so Tailscale sees connection details (which of our machines connect, their network addresses and when), not the content.United States
AnthropicProvides the Claude AI models some platform features use, such as building and reviewing websites: the content sent for those features (for example a website brief, page text or images) is processed to produce the answer. Most AI work runs on our own servers in the UK; Anthropic is used where a feature needs a larger model.United States
Microsoft (Microsoft 365)Our business email: messages you send to our email addresses (for example for support, sales or privacy requests) and our replies.Microsoft data centres, which may be outside the UK

Where a sub-processor processes personal data outside the UK, the transfer is covered by UK adequacy regulations or by the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask us at privacy@virtum.cloud for details of a particular one.

Not sub-processors

These receive personal data as separate controllers, under their own terms and privacy notices, not on our behalf:

  • Paddle. When paid platform plans go on sale, Paddle (Paddle.com Market Ltd) sells them as our reseller and Merchant of Record: it runs the checkout, takes payment, charges any VAT or sales tax and issues the invoice. Paddle is a separate controller for the payment data it collects, under its own privacy notice. We receive your name, email address, business details and the state of your subscription, never your full card details.
  • Google, Microsoft and GitHub. Only if you choose to sign in with one of them. The provider confirms who you are and shares your name and email address with us. Each is a separate controller under its own privacy notice.
  • AI providers you connect. If your organisation connects its own account with an AI provider (for example for coding sessions), the content those features send goes to that provider under your organisation's own agreement with it.

Changes to this list

Before we add or replace a sub-processor, we update this page and email the owners of customer accounts at least 30 days in advance, unless a change is needed sooner to keep the service secure or working, in which case we tell them as soon as we can. Customers can object as our data processing terms describe.

Virtum Cloud Ltd, registered in England and Wales, company number 17239759. Registered office: 38 Beechfield House, Macclesfield, Cheshire, SK11 0LP, United Kingdom. In this list, "Virtum", "we" and "us" mean Virtum Cloud Ltd.

You can contact us at sales@virtum.cloud, or about your personal data at privacy@virtum.cloud.

See also our privacy notice and data processing terms.