Sub-processors
Last updated: 26 May 2026
This page lists the sub-processors Run With Ops Ltd ("RWO") uses to provide The Run System ("Service"). Sub-processors process Customer Personal Data on RWO's instructions to support specific functions of the Service.
Each sub-processor is bound by a written agreement requiring it to process personal data only on documented instructions and to maintain appropriate technical and organisational security. If you are a customer subscribed to change notifications, we'll email you at least 30 days before adding or replacing a sub-processor. To subscribe, email [email protected].
Infrastructure and hosting
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Railway Corp. | Cloud hosting for app.therunsystem.com (FastAPI app and supporting services) | EU-West (Amsterdam) | UK IDTA / SCCs (where data leaves UK/EEA) |
| Cloudflare, Inc. | DNS, CDN, DDoS protection, bot management | Global (UK presence) | UK IDTA / SCCs |
| Wix.com Ltd | Marketing site hosting (therunsystem.com) | Ireland / United States | UK IDTA / SCCs where data leaves the UK/EEA |
Source control and developer tooling
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| GitHub, Inc. (Microsoft) | Source code repository, CI/CD, issue tracking. No customer data is stored in GitHub. | United States | UK IDTA / SCCs |
AI and machine learning
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | LLM inference for TRS agents (zero-retention mode where applicable) | United States | UK IDTA / SCCs; zero-data-retention enterprise tier where applicable |
Email, calendaring and productivity
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC (Google Workspace) | Business email, calendar, documents, internal collaboration | United States | UK Extension to the EU-US Data Privacy Framework |
Analytics
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Marketing site analytics in aggregate | United States | UK Extension to the EU-US Data Privacy Framework |
Future additions
Services we expect to add as sub-processors in the coming months. We'll update this list and notify customers as required:
- Stripe — payment processing (when self-serve checkout ships)
- Postmark / Resend — transactional email (when notifications + magic-link auth ship)
- Microsoft (OneDrive) and Google (Drive) — only as customer-elected backup destinations, where customers explicitly connect their own account to receive copies of their data
- A secrets manager (Doppler or AWS Secrets Manager) — for OAuth token + encryption key storage
- A product analytics tool (PostHog or similar) — in-product behavioural analytics on app.therunsystem.com
Notes
Ad platforms are not sub-processors. When a customer connects an ad platform (Meta, Google Ads, CM360, DV360, LinkedIn, TikTok, Reddit, Snapchat etc.), the customer's data flows directly between the customer and that platform. RWO acts on the customer's behalf via API connections the customer authorises, but the ad platforms operate as independent controllers (or as the customer's own processors), not as our sub-processors.
Where we are a controller, not a processor. Some of the providers above (for example our payment processor and Google Workspace for our own corporate email) operate as processors for RWO in connection with our own business, rather than as sub-processors for customer Personal Data. They are listed here for transparency.
Change notifications
To receive email notice of changes to this list at least 30 days in advance, email [email protected] with "Subscribe to sub-processor notifications" in the subject line and your name, company and role.
Questions? Email [email protected].