Common Mechanics

Data Processing Agreement

Where we handle personal data on a client's behalf we do it as their processor, under the agreement published here. This page holds the agreement itself and the current list of sub-processors.

Check this page periodically — last updated

The agreement

Every version of our Data Processing Agreement is published and archived here. Superseded versions stay online so you can always read the terms that applied to a past engagement.

If you need a signed agreement for your own compliance records, we will sign the DPA with you. Email privacy@commonmechanics.io to arrange it.

Sub-processors

These are the third parties that may process personal data belonging to our clients, or to their customers and users, in the course of our work. For each one we record the contracting legal entity, what it does for us, the countries it processes or stores the data in, its data processing agreement and the safeguard that covers any transfer outside the UK and the European Economic Area. Select a sub-processor to see these details. The list is versioned: each version is published in full and is never edited afterwards.

We also hold the registered office and a contact point for every sub-processor. Email privacy@commonmechanics.io and we will send them to you.

Version 1.2 · effective

Previous versions

Version 1.1 · effective
  • Vercel – Web hosting
    Entity
    Vercel, Inc.
    Processed In
    United States, Vercel global edge network
    Their DPA
    vercel.com/legal/dpa
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Cloudflare – Web hosting
    Entity
    Cloudflare, Inc.
    Processed In
    United States, Cloudflare global edge network
    Their DPA
    www.cloudflare.com/cloudflare-customer-dpa/
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Hetzner – Servers and infrastructure for client projects
    Entity
    Hetzner Online GmbH
    Processed In
    Germany, Finland
    Their DPA
    www.hetzner.com/AV/DPA_en.pdf
    Transfer Safeguard
    None required — processed in the EU/EEA (covered by UK adequacy regulations)
  • Neon – Managed Postgres databases for client applications
    Entity
    Databricks, Inc.
    Processed In
    European Union, United Kingdom, United States
    Their DPA
    databricks.com/dpa
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • GitHub – Source code repositories, issue tracking and build automation
    Entity
    GitHub, Inc.
    Processed In
    United States, European Union
    Their DPA
    github.com/customer-terms
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Blacksmith – Continuous integration runners for client project builds
    Entity
    Blacksmith Software, Inc.
    Processed In
    United States, European Union
    Their DPA
    docs.blacksmith.sh/about/data-processing-addendum
    Transfer Safeguard
    EU standard contractual clauses, with the UK International Data Transfer Addendum
  • Resend – Transactional email delivery for client applications
    Entity
    Plus Five Five, Inc. (trading as Resend)
    Processed In
    United States
    Their DPA
    resend.com/legal/dpa
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • PostHog – Website and product analytics
    Entity
    PostHog, Inc.
    Processed In
    European Union, United States
    Their DPA
    posthog.com/dpa
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Google – File storage, documents, calendars and email
    Entity
    Google Cloud EMEA Limited
    Processed In
    European Union, United States
    Their DPA
    cloud.google.com/terms/data-processing-addendum
    Transfer Safeguard
    Contracting entity in the EU/EEA (covered by UK adequacy regulations; no safeguard needed for EU transfers)
  • Notion – Internal documentation and project management
    Entity
    Notion Labs, Inc.
    Processed In
    United States
    Their DPA
    www.notion.com/help/privacy
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Linear – Issue tracking and project management
    Entity
    Linear Orbit, Inc.
    Processed In
    United States
    Their DPA
    linear.app/dpa
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Slack – Internal and client communications
    Entity
    Slack Technologies Limited
    Processed In
    United States, European Union
    Their DPA
    slack.com/terms-of-service/data-processing
    Transfer Safeguard
    Contracting entity in the EU/EEA (covered by UK adequacy regulations; no safeguard needed for EU transfers)
  • Figma – Interface design, prototyping and design review
    Entity
    Figma, Inc.
    Processed In
    United States
    Their DPA
    www.figma.com/legal/dpa/
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Adobe – Image, video and document production
    Entity
    Adobe Systems Software Ireland Limited
    Processed In
    European Union, United States
    Their DPA
    www.adobe.com/go/dpa-ww
    Transfer Safeguard
    Contracting entity in the EU/EEA (covered by UK adequacy regulations; no safeguard needed for EU transfers)
  • 1Password – Credential storage and sharing
    Entity
    AgileBits Inc.
    Processed In
    Canada, United States
    Their DPA
    1password.com/legal-center/DPA
    Transfer Safeguard
    Contracting entity in Canada (covered by UK and EU adequacy decisions)
  • Anthropic – AI inference for development and content work
    Entity
    Anthropic Ireland, Limited
    Processed In
    United States, European Union
    Their DPA
    www.anthropic.com/legal/data-processing-addendum
    Transfer Safeguard
    Contracting entity in the EU/EEA (covered by UK adequacy regulations; no safeguard needed for EU transfers)
  • OpenAI – AI inference for development and content work
    Entity
    OpenAI OpCo, LLC
    Processed In
    United States, European Union
    Their DPA
    openai.com/policies/data-processing-addendum/
    Transfer Safeguard
    EU standard contractual clauses, with the UK International Data Transfer Addendum
  • Pastel – Website review and feedback collection on client sites
    Entity
    Pastel Labs Inc.
    Processed In
    Not yet confirmed by the provider
    Their DPA
    None published by Pastel
    Transfer Safeguard
    Not yet confirmed by the provider
  • Loom – Screen and video recording for client communication
    Entity
    Loom, Inc. (Atlassian subsidiary)
    Processed In
    United States; support and technical services in other countries via Atlassian and PartnerHero
    Their DPA
    www.atlassian.com/legal/loom/dpa
    Transfer Safeguard
    EU-US Data Privacy Framework, including the UK Extension (UK-US Data Bridge)
  • Airtable – Databases and workflow tools for client projects
    Entity
    Formagrid Inc (dba Airtable)
    Processed In
    United States
    Their DPA
    www.airtable.com/company/dpa
    Transfer Safeguard
    EU standard contractual clauses, with the UK International Data Transfer Addendum
Version 1.0 · effective
  • Vercel – Web hosting
    Entity
    Vercel, Inc.
    Processed In
    United States, Vercel global edge network
  • Cloudflare – Web hosting
    Entity
    Cloudflare, Inc.
    Processed In
    United States, Cloudflare global edge network
  • Hetzner – Servers and infrastructure for client projects
    Entity
    Hetzner Online GmbH
    Processed In
    Germany, Finland
  • Neon – Managed Postgres databases for client applications
    Entity
    Databricks, Inc.
    Processed In
    European Union, United Kingdom, United States
  • GitHub – Source code repositories, issue tracking and build automation
    Entity
    GitHub B.V.
    Processed In
    United States, European Union
  • Blacksmith – Continuous integration runners for client project builds
    Entity
    Blacksmith Software, Inc.
    Processed In
    United States, European Union
  • Resend – Transactional email delivery for client applications
    Entity
    Plus Five Five, Inc. (trading as Resend)
    Processed In
    United States
  • PostHog – Website and product analytics
    Entity
    PostHog, Inc.
    Processed In
    European Union, United States
  • Google – File storage, documents, calendars and email
    Entity
    Google Ireland Limited
    Processed In
    European Union, United States
  • Notion – Internal documentation and project management
    Entity
    Notion Labs, Inc.
    Processed In
    United States
  • Linear – Issue tracking and project management
    Entity
    Linear Orbit, Inc.
    Processed In
    United States
  • Slack – Internal and client communications
    Entity
    Slack Technologies Limited
    Processed In
    United States, European Union
  • Figma – Interface design, prototyping and design review
    Entity
    Figma, Inc.
    Processed In
    United States
  • Adobe – Image, video and document production
    Entity
    Adobe Systems Software Ireland Limited
    Processed In
    European Union, United States
  • 1Password – Credential storage and sharing
    Entity
    AgileBits Inc.
    Processed In
    Canada, United States
  • Anthropic – AI inference for development and content work
    Entity
    Anthropic Ireland, Limited
    Processed In
    United States, European Union
  • OpenAI – AI inference for development and content work — the contracting entity for customers outside the EEA and Switzerland, including the UK
    Entity
    OpenAI OpCo, LLC
    Processed In
    United States, European Union
  • OpenAI – AI inference for development and content work — the contracting entity for customers in the EEA and Switzerland
    Entity
    OpenAI Ireland Limited
    Processed In
    United States, European Union

Data protection lead

Our data protection lead is Taylor Jones (taylor@commonmechanics.io).

How we handle personal data as a controller — visitors to this site, and people who email us — is a separate matter, covered by our privacy notice.