FixMargin — Sub-processors
Version 1.3 · Effective date: 5 September 2026
This page lists the third parties Quantix Prime Ltd (trading as FixMargin; ICO registration ZC118594) uses to process Customer Data on behalf of customer organisations, as authorised under §5 of our Data Processing Addendum. It is identical to Annex 1 of the DPA and is the list we keep current.
Authorised sub-processors (as at 5 September 2026)
| Sub-processor | Service | Processing location | Transfer mechanism |
|---|---|---|---|
| Supabase Pte. Ltd (Singapore) | Database, file storage, authentication infrastructure | Data hosted in AWS eu-west-2 (London, UK) | Restricted transfer (Singapore contracting entity): UK International Data Transfer Addendum (B.1.0) to the EU SCCs, Modules 2 and 3, incorporated in Supabase’s DPA (Schedule 2) |
| Vercel Inc. (USA) | Application hosting and content delivery | Compute in Vercel London (lhr1); global edge for static content | Restricted transfer (US contracting entity): UK International Data Transfer Addendum to the EU SCCs, incorporated in Vercel’s DPA (Schedule 3 §2, Schedule 5) |
| Anthropic Ireland, Limited | AI-assisted document extraction (supplier price lists, invoices, credit notes) — only when a User submits content to the feature (Terms §7.8) | Contracting entity in Ireland (EEA); processing infrastructure primarily in the USA | UK adequacy regulations (EEA); UK International Data Transfer Addendum to the EU SCCs, Modules 2 and 3, incorporated in Anthropic’s DPA (Schedule 3 §B) for US processing; content retained up to 30 days for safety purposes only; not used to train models |
| Amazon Web Services EMEA SARL (Amazon SES) | Outbound transactional email (invitations, notifications, supplier call-off emails when used) | AWS eu-west-2 (London, UK) | Contracting entity in Luxembourg (EEA): UK adequacy regulations; AWS GDPR DPA incorporating the UK International Data Transfer Addendum for any onward access |
| PostHog Inc. | Product analytics — User identifiers and interaction events only, not document content; only with cookie consent; session replay disabled | PostHog EU Cloud (Frankfurt) | EU adequacy regulations for storage in the EU; DPA signed 2 Sep 2026 incorporating the UK International Data Transfer Addendum to the EU SCCs for any onward access; EU-US Data Privacy Framework + UK Extension |
Not a sub-processor: Stripe Payments UK Ltd processes payment transactions as an independent controller; we share only billing-contact data with it.
Changes to this list
We give customers at least 14 days' notice before adding or replacing a sub-processor (DPA §5), by email to the Admin contact of each organisation, and update this page on the same day. Customers may object on reasonable data-protection grounds within the notice period as described in the DPA.
Questions: support@fixmargin.com.