Sub-processors

Last updated: May 2026

Mustard Investments uses a limited number of third-party sub-processors to deliver its service. We notify schools at least 30 days before adding a new sub-processor, in line with our Data Processing Agreement.

Sub-processorPurposeData locationSafeguardAdded
Google Cloud Platform (Firebase)Authentication, database (Firestore), file storage, hostingUK (europe-west2, London)UK adequacy + Google Cloud DPA2026-01-01
Vercel Inc.Web application hosting and edge delivery (Next.js)UK / EU edge, US originSCCs + Vercel DPA2026-01-01
Google LLC (Analytics)Anonymised, aggregated site analytics (no student PII)EU (analytics data region setting)UK adequacy + consent-gated, anonymise_ip enabled2026-01-01

Change log

2026-01-01Initial sub-processor list published.

Notification process

When we add or change a sub-processor, we:

  1. Update this page with the new sub-processor details.
  2. Email all registered school DPOs and administrators with at least 30 days' notice.
  3. Allow schools to object in writing within the notice period. If an objection cannot be resolved, the school may terminate the DPA.

Questions

For questions about our sub-processors or data processing, contact dpo@mustardinvestments.com.

For educational purposes only. Not financial advice. Mustard Investments is not authorised or regulated by the Financial Conduct Authority.