Sub-processors

The companies that help Dealn run Dealn Squares and Dealn Events, and so may process personal data for the groups that use them. Dealn gives groups at least 30 days’ notice by email before adding or replacing one (data processing terms, section 2.4).

Vercel

• What for: Runs the application: the web pages and the code behind them.
• Where: London (UK) region for all processing. Vercel is a US company.
• Safeguards: Vercel’s data processing addendum, with the UK International Data Transfer Addendum for any access from outside the UK.
• Certified: SOC 2 Type 2 and ISO 27001 (as Vercel publishes it)

Neon

• What for: The database where everything is stored.
• Where: AWS London (UK). Neon is a US company.
• Safeguards: Neon’s data processing agreement, with the UK Addendum for any access from outside the UK.
• Certified: SOC 2 Type 2, ISO 27001 and ISO 27701 (as Neon publishes it)

Resend

• What for: Sends the emails (pick links, approvals, invites, invoices, and Dealn Events invitations and booking emails).
• Where: Dealn’s sending domains are set up in Resend’s Ireland (EU) region, which sends through Amazon SES in Ireland. Resend is a US company.
• Safeguards: Resend’s data processing agreement. The EU has UK adequacy; the UK International Data Transfer Addendum covers any access from the US.
• Certified: SOC 2 Type 2 (as Resend publishes it)

Twilio

• What for: Sends text messages, only for groups that use text messages in Dealn Events: the mobile number, the sender name and the text.
• Where: Twilio processes the messages in the United States and delivers them over UK mobile networks. Twilio is a US company.
• Safeguards: Twilio’s data protection addendum, with the UK International Data Transfer Addendum for the transfer to the United States.
• Certified: ISO 27001 and SOC 2 Type 2 (as Twilio publishes it)

Zoho

• What for: Dealn’s support and privacy mailboxes: what people write to Dealn’s support and privacy addresses (a customer asking about their details, say), and Dealn’s replies. The service itself sends nothing there.
• Where: Zoho’s UK data centre. Zoho is an Indian company.
• Safeguards: Zoho’s data processing agreement, with the UK Addendum to the EU standard contractual clauses for any access from outside the UK.
• Certified: ISO 27001 and SOC 2 Type 2 (as Zoho publishes it)
• Added: 14 October 2026

Last updated with version 2026-10-v4. Questions: privacy@dealn.co.uk.