Sub-processors
The third-party sub-processors Journey uses to deliver its apprenticeship platform: who they are, what they do and where your provider's data is processed.
Last updated: 6 October 2026
These are the suppliers Journey uses to process personal data for training providers, what each one does and where it processes data. Each is bound by a written contract with data protection obligations at least as protective as our data processing terms.
Used for every workspace
| Sub-processor | What it does | Data it handles | Where it processes data |
|---|---|---|---|
| Anthropic, PBC | Claude AI models, called directly, for Journey Advanced resource writing and the employer summary | The content needed for the request, such as the programme details or the learner progress being summarised | United States. Transfer safeguard: EU Standard Contractual Clauses with the UK Addendum, in Anthropic’s data processing addendum. Anthropic’s commercial terms do not allow it to train models on API data. |
| OpenAI, L.L.C. (through Vercel AI Gateway) | AI models for Journey AI answers, drafting, speech-to-text and read-aloud | The content needed for the request: the question and the permitted record facts, the text being drafted or read aloud, or the audio being transcribed | United States. Transfer safeguard: EU Standard Contractual Clauses with the UK Addendum, in OpenAI’s data processing addendum. Requests are sent with storage turned off, and OpenAI does not train models on API data. |
| Vercel, Inc. | Application hosting, API runtime and AI Gateway routing | Application data in transit, request metadata and AI requests on their way to the model provider | Application functions run in London (lhr1); content is delivered through Vercel’s global edge network. Transfer safeguard for anything handled in the United States: the UK-US data bridge, as Vercel is certified to the UK Extension to the EU-US Data Privacy Framework. |
| Neon, Inc. | Managed PostgreSQL database for the live service | All workspace records held in Journey | London, United Kingdom (AWS eu-west-2). |
| Cloudflare, Inc. | Evidence file storage (R2), DNS and edge protection | Uploaded evidence files, and network and request metadata | Files are stored in Cloudflare R2 under its EU jurisdiction setting. DNS and edge protection run on Cloudflare’s global network. Transfer safeguard for anything handled in the United States: the UK-US data bridge, as Cloudflare is certified to the UK Extension to the EU-US Data Privacy Framework, with contractual clauses in its data processing addendum as a fallback. |
| Google Cloud (Google LLC), Cloud Run | Virus scanning of every uploaded file before it is stored | The uploaded file, sent only to Journey’s own scanning container. Nothing is kept there after the scan. | London, United Kingdom (europe-west2). |
| Clerk, Inc. | Sign-in, multi-factor authentication and session management | Name, email address, sign-in events and session identifiers | United States. Transfer safeguard: the UK-US data bridge (Clerk is certified to the UK Extension to the EU-US Data Privacy Framework), with contractual clauses in Clerk’s data processing addendum as a fallback. |
| Resend, Inc. | Transactional email, such as invitations, reminders and notifications | Recipient address, message content and delivery events | Ireland (AWS eu-west-1). |
| Functional Software, Inc. (Sentry) | Error and performance diagnostics | Account, workspace, role and request context, with credentials, tokens, payment-card data, signatures and file contents excluded | Germany (Sentry EU region). |
| PostHog, Inc. | Product analytics and session diagnostics, only after consent | After consent: account, workspace, role and interaction context, with typed fields masked and credentials, tokens, payment-card data, signatures and file contents excluded | European Union (PostHog EU cloud). |
| Stripe Payments Europe Ltd. | Subscription billing and payments where enabled | Billing contact, plan and payment metadata. Journey does not store card numbers. | Ireland and the EEA. |
| IDDQD Limited, trading as Ideal Postcodes | Postcode lookup that fills in the town and county during onboarding | The postcode typed into the form only, sent from Journey’s server | United Kingdom company. Ideal Postcodes does not publish a hosting region and says some data may be stored outside the EEA under GDPR-equivalent safeguards. |
Used only when your centre connects them
Meeting transcripts reach Journey only if your centre connects its own Google or Microsoft account. Journey then fetches the transcripts your centre chooses.
| Sub-processor | What it does | Data it handles | Where it processes data |
|---|---|---|---|
| Google LLC (Google Meet) | Fetching meeting transcripts, only when your centre connects its own Google Workspace account | Transcripts of the meetings your centre chooses to bring into Journey | Held in your centre’s own Google Workspace. Your centre’s agreement with Google covers its own tenant, and Google remains your centre’s processor for it. |
| Microsoft Corporation (Microsoft Teams) | Fetching meeting transcripts, only when your centre connects its own Microsoft 365 account | Transcripts of the meetings your centre chooses to bring into Journey | Held in your centre’s own Microsoft 365 tenant. Your centre’s agreement with Microsoft covers its own tenant, and Microsoft remains your centre’s processor for it. |
No AI training on your data
Journey never uses customer data to train its own AI models or anyone else’s. We only use AI suppliers whose terms do not allow them to train their models on the data Journey sends them.
Changes and your right to object
Before we add or replace a sub-processor, we email your workspace administrators and update this page at least 30 days before the change takes effect. You can object on reasonable data protection grounds within those 30 days by emailing privacy@journeyapp.co.uk. We will work with you to resolve the objection. If we cannot, you may end the affected service without penalty, as set out in section 4 of the data processing terms.
This website
The public website uses Google Analytics only after you accept analytics cookies. Tech Geek UK Ltd is the controller for that data, so Google Analytics is not a sub-processor for provider workspaces. See the privacy policy.
See also: Privacy policy · Terms of service
See what changes
when it all connects.
Bring your learners’ journey, your team’s questions and your next ambition.