Skip to content
Scout Suite
Uniform designer

Legal

Sub-processors

The companies we use to process personal data for the organisations that use Scout Suite.

Effective from 16 October 2026 · Version 2026-10-16

Everycast Labs Ltd uses the companies below to process personal data on behalf of the Groups, Districts and Counties that use Scout Suite. This list forms part of our Data Processing Agreement.

Core companies are used for every organisation. Optional companies only receive personal data when your organisation uses the feature that needs them.

  • Cloudflare, Inc.

    Core
    What they do
    Hosting, database, file storage, sending and receiving email, creating PDFs, online meetings, logs and security. Also hosts vcon.store, our conversation record service.
    Personal data
    All data held in Scout Suite.
    Where
    United States company with data centres worldwide. Database and files: Western Europe. Website visits are handled at the data centre nearest the visitor.
    Transfer safeguard
    Cloudflare states that it is certified under the EU-US Data Privacy Framework and its UK Extension (the UK-US data bridge). Its data processing terms also include standard contractual clauses and the UK Addendum if those certifications lapse.
    Data processing agreement
    Cloudflare's data processing addendum, part of its terms.
    When used
    Always.

  • PostHog Inc.

    Core
    What they do
    Analytics for our website and app. No screen recordings, names or email addresses.
    Personal data
    Pages viewed, a few actions, browser and device details, approximate location from IP address, and a random ID.
    Where
    EU: Frankfurt, Germany (PostHog EU Cloud, hosted on AWS in eu-central-1).
    Transfer safeguard
    Stored in Frankfurt, Germany. Our signed data processing agreement (3 November 2026) lets PostHog's sub-processors process data outside the UK and EU, including in the US. PostHog participates in the EU-US Data Privacy Framework and its UK Extension, and the agreement includes standard contractual clauses and the UK Addendum.
    Data processing agreement
    Signed with PostHog on 3 November 2026. See PostHog's DPA.
    When used
    Unless you turn analytics off. See our Privacy Policy.

  • Stripe

    Core
    What they do
    Billing for Scout Suite subscriptions, phone numbers and eSIMs, and online payments for organisations that use our payments setup.
    Personal data
    Billing contacts, payer names and email addresses, and payment details, which Stripe holds and we don't. Stripe is our processor for taking payments, and an independent controller for fraud prevention, its legal obligations and improving its own services.
    Where
    United States, and India for some regulated data. Stripe's data centres are outside the UK and EU.
    Transfer safeguard
    Stripe, LLC is certified under the UK Extension to the UK-US data bridge. Stripe's data processing agreement also includes standard contractual clauses and the UK Addendum.
    Data processing agreement
    Stripe's data processing agreement.
    When used
    Always, for billing. For payments, when your organisation takes them online.

  • Cloudflare, Inc. (Workers AI)

    Optional
    What they do
    Runs the AI models for the assistant, meeting minutes, reading receipts, writing help, suggestions, imports, reading text aloud and the phone agent's replies. The models run on Cloudflare's servers, and the companies that made them receive nothing.
    Personal data
    The text, images or audio sent to each feature, which can include details about members and young people.
    Where
    The same place as the Cloudflare Worker that sends the request. We ask for the UK, but a request can run elsewhere in Cloudflare's network, for example during an outage.
    Transfer safeguard
    As for Cloudflare above. Not used to train models.
    Data processing agreement
    As for Cloudflare above.
    When used
    When someone uses an AI feature, or a call flow uses the phone agent.

  • Deepgram, Inc.

    Optional
    What they do
    Turns speech into text.
    Personal data
    Audio of recorded meetings, voicemails, voice notes and phone agent calls, which can include anything said.
    Where
    EU, using Deepgram's EU endpoint, which stores data within the EU and fails rather than falling back to another region. This covers transcripts of meetings, voicemails and voice notes, and the phone agent's calls.
    Transfer safeguard
    We send Deepgram's model improvement opt-out on every request, so audio and transcripts are kept only while the request is processed (usage logs are kept for 90 days) and aren't used for training or benchmarking. Deepgram publishes its sub-processors at deepgram.com/privacy/subprocessors. We have asked Deepgram for a data processing agreement that includes the UK Addendum.
    Data processing agreement
    Requested from Deepgram. Deepgram doesn't publish its agreement.
    When used
    Meeting and voicemail transcripts, voice notes, and the phone agent.

  • ElevenLabs

    Optional
    What they do
    Speaks call flow messages and the phone agent's replies.
    Personal data
    The text being spoken, which can include names and details the phone agent looks up for a caller.
    Where
    United States. ElevenLabs stores customer data in the US by default. Its EU data residency is an Enterprise feature, which we don't use.
    Transfer safeguard
    ElevenLabs' data processing addendum applies to our business account through its Terms of Use, and covers transfers with the EU-US Data Privacy Framework, standard contractual clauses and the UK Addendum. We have switched off its use of our data to train its models.
    Data processing agreement
    ElevenLabs' data processing addendum, part of its Terms of Use for business accounts.
    When used
    Group phones with call flows or the phone agent.

  • Telnyx LLC

    Optional
    What they do
    Phone numbers, phone calls and SMS.
    Personal data
    Phone numbers, call details, message content, and the address details needed for a UK phone number.
    Where
    United States (Telnyx's primary processing facilities), with a network anchor site in London, UK.
    Transfer safeguard
    Telnyx's data processing addendum includes standard contractual clauses and the UK International Data Transfer Addendum, and Telnyx is certified under the EU-US Data Privacy Framework.
    Data processing agreement
    Telnyx's data processing addendum (version 3.0).
    When used
    Group phone numbers, SMS and call flows.

  • Meta Platforms (WhatsApp)

    Optional
    What they do
    WhatsApp messages and calls.
    Personal data
    Phone numbers, message content and media.
    Where
    United States. As a UK business our contracting company is WhatsApp LLC, which processes the messages for us, with Meta Platforms, Inc. also receiving transferred data.
    Transfer safeguard
    WhatsApp's Business UK Data Transfer Addendum, which uses the EU standard contractual clauses and the UK Addendum.
    When used
    WhatsApp messaging and calling.

  • IQ Mobile Limited, with Transatel for travel eSIMs

    Optional
    What they do
    Leader eSIMs, and travel data eSIMs on the Transatel network.
    Personal data
    Leader name, email and number, SIM details and usage. For travel eSIMs, only the SIM and the data bundle bought: no traveller details.
    Where
    UK (iQ Mobile). France (Transatel).
    Transfer safeguard
    UK, and the EU, which UK law treats as adequate.
    Data processing agreement
    IQ Mobile publishes no agreement. Its data protection policy says it handles personal data in line with UK GDPR. We have asked for one.
    When used
    Leader eSIMs and travel eSIMs.

  • GoCardless Ltd

    Optional
    What they do
    Bank feeds: brings your organisation's bank transactions into Scout Suite through Open Banking.
    Personal data
    Bank transactions, including payer names and references.
    Where
    UK and EU.
    Transfer safeguard
    UK, and the EU, which UK law treats as adequate.
    Data processing agreement
    GoCardless's terms for Bank Account Data apply. We have asked whether it offers a separate agreement.
    When used
    When your organisation connects a bank feed.

  • Microsoft (Azure Communication Services)

    Optional
    What they do
    Teams calling and meetings inside Scout Suite.
    Personal data
    Names, meeting content, recordings and transcripts.
    Where
    United Kingdom: data at rest stays in the UK geography set on our Azure resource. Calls are processed in real time, and Microsoft may route them through other locations. Nothing is kept apart from monitoring logs.
    Transfer safeguard
    Microsoft's data protection addendum, part of its product terms, which covers transfers outside the UK, EEA and Switzerland with standard contractual clauses and the UK International Data Transfer Addendum. Microsoft also states that it is certified under the data privacy frameworks.
    Data processing agreement
    Microsoft's data protection addendum, part of its product terms.
    When used
    Only if your organisation connects Microsoft 365.

Not on this list

Our own systems. Our phone system, which connects calls and carries call audio, runs on our own servers in the UK, managed by us. vcon.store, where conversation records are kept, is our own service, hosted on Cloudflare.

Your organisation's own accounts. Some features connect to an account your organisation has with another company, such as its own Stripe, Square or GoCardless account for taking payments, Microsoft 365, a Facebook Page or its website. Those companies work for your organisation directly, under your organisation's agreement with them. For GoCardless, GoCardless and your organisation are independent data controllers of your payers' details in that account.

Sign-in providers. If you sign in with Google, Microsoft, Apple, GitHub or Facebook, that company handles your sign-in under its own terms.

Payment firms' own role. For much of their payment processing, Stripe and GoCardless are responsible for the data themselves, as regulated payment firms. They're listed above for the work they do for us.

How we tell you about changes

  • At least 30 days before a new sub-processor starts processing personal data for organisations, we update this page and add an entry to the change log below.
  • We email the admins of every organisation it affects, and show a notice in Scout Suite.
  • Anyone can follow the change log with our Atom feed, which works in any RSS reader.
  • If we have to replace a provider urgently, for example because of a security problem or a provider closing, we give as much notice as we can and explain why. You can still object.
  • We also update this page when we stop using a company, or when a company's location changes. If a change of location gives your data less protection, we email you first.

How to object

If you have a reasonable data protection concern about a new sub-processor, email privacy@scoutsuite.app within the 30 days and tell us why.

We'll work with you to resolve it. For example, we may be able to keep your organisation off the new provider, or turn the affected feature off for you.

If we can't resolve it: for an optional sub-processor, you can stop using the feature that needs it, and we can turn it off for your organisation. For a core sub-processor, you can end your use of Scout Suite before the change takes effect.

Change log

  1. Sub-processor list published

    We published our list of sub-processors for the first time.

Change log feed (Atom)