These are the companies Telore uses to run the service that process personal data on our behalf. Each is bound by a written contract to process it only on our instructions and to protect it as our data processing terms require. We email the owners of every company at least 30 days before we add or replace one.
What for: hosting the application (EC2), the database (RDS), storing files (S3) and keeping the service's configuration secrets (Systems Manager). What it receives: everything held in Telore, stored on infrastructure we control and encrypted at rest. Where: the United Kingdom — the London region (eu-west-2).
What for: telling us when something in Telore fails. What it receives: technical detail about the failure, the address of the page without its query string, the browser type, and our own internal numbers for the account and the company. Never request contents, financial records, names, amounts, or what a bank or payment provider sent us — those are replaced by a reference before anything is sent. Where: the European Union (Germany), which UK law recognises as giving adequate protection.
What for: the support messenger and support tickets. What it receives: when you are signed in, your name, email address, the date you joined and your language, and your company's name and plan; what you write to us; and the page you are on and its title — which, inside Telore, never carry a customer's name, a description or an amount, and the messenger is not loaded on a page whose address holds a search or a record. Where: the United States, under the EU-US Data Privacy Framework and its UK Extension.
What for: the optional identity check for people who run a company. What it receives: the identity document and short selfie video the person shows it on its own page, and the result of the check. Telore sends it only a reference and a return address. Where: the European Union, on Amazon Web Services infrastructure there, which UK law recognises as giving adequate protection.
Who: MailerSend (MailerSend Inc.). What for: sending Telore's email — account and security messages, and the invoices, reminders and other documents your company asks us to send. What it receives: the recipient's address, the message and its attachments. Where: the European Union, which UK law recognises as giving adequate protection.
What for: signing in, when you choose "Continue with Google". What it receives: that you are signing in to Telore. It tells us your name and email address. Where: the United States, under the EU-US Data Privacy Framework and its UK Extension.
Open Exchange Rates, HMRC's published exchange rates and the European Central Bank give us exchange rates; we send them a currency and a date, nothing about you. When you choose a password, Have I Been Pwned is sent the first five characters of a fingerprint of it, never the password, to check it has not appeared in a known breach. These are not sub-processors.
Telore's pages load their typefaces from Google Fonts, so your browser asks Google for them and Google sees your IP address. The support messenger, above, loads from Intercom.
Stripe, Wise, Airwallex and your UK bank through Open Banking are not our sub-processors. They hold your data already, under their own privacy notices; connecting one gives Telore permission to read it, as our privacy policy explains. What you file goes to HMRC or Companies House as the law requires.
End of this document · Last updated 14 October 2026
Back to the top