SENSERITY — Sub-Processors
Version 1.0 | September 2026
Provider: Blueloop Limited Company No: 03981322 Registered Office: Blueloop House, Ilchester Road, Yeovil, Somerset BA21 3AA Data Protection Lead: Robin Barker Contact: legal@senserity.co.uk
1. Purpose of This Page
This page lists every third-party provider that processes data on behalf of Blueloop Limited in connection with the Senserity platform (app.senserity.co.uk) and the Senserity website (senserity.co.uk).
We publish it so that customers, prospective customers, and anyone completing supplier due diligence on us can see the full picture in one place without having to ask. It is referenced by our Terms of Service (clause 11.6), our Privacy Policy (Section 6.1), and our Data Processing Addendum (Section 4.1).
2. Where Your Data Actually Lives
The Senserity platform runs on infrastructure owned and operated by Blueloop Limited within the United Kingdom. That includes the application servers, the database, and file storage.
The following are stored only in the United Kingdom and are never sent to any provider listed below:
- Your watchlists, including which companies you monitor and how you have labelled them
- Attestation questionnaires and the responses given to them
- Documents you upload as evidence
- Notes you record against a company
- Company Data aggregated from public registers and commercial providers
- Risk scores, insight test results, and generated reports
3. Current Sub-Processors
| Provider | Legal entity | Function | Processing location | Data processed | Retention |
|---|---|---|---|---|---|
| Stripe | Stripe Payments Europe, Limited (Ireland) | Payment and subscription processing | EEA, with onward transfers to the US under Standard Contractual Clauses | Billing contact details, payment metadata, subscription status. Card details are handled by Stripe and never reach our systems | Per Stripe's retention policy and UK tax record requirements |
| Microsoft | Microsoft Ireland Operations Limited | Sign-in with Microsoft (Entra ID) and delivery of transactional email (Graph API) | Global, under Standard Contractual Clauses and the UK International Data Transfer Addendum | Your name and email address; recipient address and message content for emails we send you | Per Microsoft's retention policy |
| Google Ireland Limited | Sign-in with Google (OAuth) | Global, under Standard Contractual Clauses and the UK International Data Transfer Addendum | Your name and email address | Per Google's retention policy | |
| Sentry | Functional Software, Inc., trading as Sentry (United States). Blueloop uses the EU region | Application error monitoring | European Union (Frankfurt, Germany) | When an error occurs: the error message, stack trace, the page you were on, browser and operating system, and a pseudonymous user identifier | 90 days |
| PostHog | PostHog, Inc. (United States). Blueloop uses PostHog Cloud EU | Product analytics | European Union (Frankfurt, Germany) | Records of actions taken in the Platform, such as pages opened and features used, with pseudonymous user and tenant identifiers | 12 months |
| Plausible | Plausible Insights OÜ (Estonia) | Website analytics for senserity.co.uk only. Not used on the Platform | European Union (Germany) | Aggregate page view counts, referral source, country, device type. No personal data and no cookies | Aggregate only; no individual records retained |
4. How We Limit What Providers Receive
No cookies or device storage for analytics. PostHog is configured to hold its state in memory for the duration of a page only. It identifies you from your existing authenticated session rather than from anything written to your device. Sentry sets no cookies. Plausible is cookieless by design. Because none of them store or read information on your device, none requires consent under the Privacy and Electronic Communications Regulations 2003.
Deliberate events, not automatic capture. PostHog autocapture is disabled. We record a defined set of product events that we have chosen, rather than everything a user does on a page.
No session recording. Session replay of general browsing is disabled. Sentry captures a masked replay only when an error occurs, to help us reproduce the fault.
Scrubbing before transmission. Error reports are stripped of tenant and user identifiers, respondent access tokens, and query string parameters before they leave the browser or server. Company numbers are not scrubbed: they are public record and removing them only makes faults harder to diagnose.
Analytics off on the respondent portal. Product analytics, session replay and performance tracing do not run on the attestation respondent portal. People invited to answer an attestation questionnaire are not our users and are not subject to any analytics. Error monitoring does run there, because a fault that stops a respondent submitting is one they have no way to report to us, and we would rather know. The respondent's access token is stripped from those reports before they leave the browser.
5. How We Manage These Providers
Each provider is assessed and recorded on the Blueloop supplier register under our ISO 27001 supplier relationships controls, and each is engaged under a written data processing agreement imposing obligations no less protective than those we owe our own customers. We remain fully liable to our customers for the performance of each provider.
Blueloop Limited holds ISO 27001 (Information Security Management), ISO 9001 (Quality Management), and Cyber Essentials, each including Senserity within scope.
6. Changes to This List
We will update this page before engaging any new sub-processor.
Where a new sub-processor would process Customer Content, we will give affected customers at least 30 days' notice in advance, in accordance with Section 4.3 of our Data Processing Addendum. Customers may object on reasonable grounds, and where an objection cannot be resolved, may terminate the affected services without penalty.
To be notified of changes to this list, email legal@senserity.co.uk.
7. Your Rights
Error monitoring and product analytics are carried out on the basis of legitimate interest under Article 6(1)(f) of the UK GDPR. You have the right to object under Article 21(1). Email legal@senserity.co.uk and we will exclude your account from product analytics collection. We will not ask you to justify the request.
Your wider rights, and how to exercise them, are set out in Section 9 of our Privacy Policy.
8. Version History
| Version | Date | Changes |
|---|---|---|
| 1.0 | September 2026 | Initial publication. Consolidates the sub-processor disclosures previously spread across the Privacy Policy, Terms of Service and Data Processing Addendum, and adds Sentry, PostHog and Plausible. |
9. Contact
Data Protection Lead: Robin Barker Email: legal@senserity.co.uk Post: Blueloop Limited, Blueloop House, Ilchester Road, Yeovil, Somerset BA21 3AA