1. Summary
All data processed to perform a CoP lookup is stored at rest in the United Kingdom and processed within the United Kingdom on infrastructure in the AWS London region (eu-west-2) and Vercel’s London region (lhr1).
whoamipaying? is operated by a UK company and complies with the UK GDPR and the Data Protection Act 2018. International transfers (where they occur, see §4) are governed by the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, or by adequacy regulations.
2. Hosting infrastructure
| Component | Vendor | Region | Data held | Transfer safeguard |
|---|---|---|---|---|
| Database, auth, audit record storage | Supabase Inc. (on AWS) | eu-west-2 (London) | User account, CoP request and response records, credit ledger entries | UK IDTA + SCCs (vendor US-incorporated; control-plane access from US) |
| Serverless compute (API routes) | Vercel Inc. | lhr1 (London) — pinned via vercel.json | Transient request/response data only; no data stored at rest | UK IDTA + SCCs |
| Edge middleware, static assets, CDN | Vercel Inc. | Global edge | Supabase session cookie value (in transit only) and public static files — no customer CoP data processed, stored, or logged at edge | N/A |
| Source code | GitHub (Microsoft Corporation) | United States | Application source code only. No customer data in repository, seeds, or history. | UK IDTA + SCCs |
| Build artifacts, deployment logs, platform metadata | Vercel Inc. | United States | Deployment metadata, build logs. May incidentally contain request IDs and error traces; does not contain CoP request payloads or response data. | UK IDTA + SCCs |
3. Sub-processors invoked during a CoP lookup
A single CoP lookup invokes exactly two external services. Both are United Kingdom entities operating UK-resident infrastructure.
Companies House (GOV.UK)
Company registration lookup — resolves the beneficiary company name used in the CoP match
Data sent
Company name and/or company registration number
PayPoint plc / Pay.UK (Confirmation of Payee scheme)
Bank account name verification against the Pay.UK CoP network
Data sent
Sort code, account number, beneficiary name / company name
No other sub-processor is invoked during a CoP lookup.
4. Known residency limitations
whoamipaying? is operated by a UK company on infrastructure whose data at rest sits in the United Kingdom. Procurement reviewers should be aware of the following residual exposures:
Control-plane access
Supabase and Vercel are US-incorporated. Their engineering and support staff may access customer data from the United States under their respective DPAs. International transfers are covered by the UK IDTA; true “no US access” would require the Enterprise tier of each vendor (with Bring-Your-Own-Cloud) or self-hosting.
Platform metadata
Vercel deployment logs, build artifacts, and error telemetry are stored in the United States. These do not contain CoP request payloads or response data, but may contain request IDs, timestamps, and hashed error fingerprints.
Source code hosting
Application source is on GitHub.com (US). Source code contains no customer data; migration to GitHub Enterprise Cloud with EU data residency is available if required by procurement.
5. Data subject rights
UK data subjects may exercise their rights under the UK GDPR (access, rectification, erasure, restriction, portability, objection) by contacting hello@whoamipaying.com. Requests are typically fulfilled within 30 days.
6. Notification of changes
Material changes to this register — new sub-processors, changed data categories, or changed hosting regions — will be notified to customers at least 30 days in advance by email to the account owner and published at https://whoamipaying.co.uk/data-residency.
7. Contact
- Data Controller
- eBanking Integration Ltd (company no. 06596920), United Kingdom
- Data Protection enquiries
- hello@whoamipaying.com
- Supervisory authority
- Information Commissioner’s Office (UK)