Sub-processors
Review the current Vamiq by ScotiTech sub-processor list for infrastructure, billing, email delivery, Apple Business workflows, and optional services.
A sub-processor is a third party that processes personal data on AppDeploy's behalf to help us deliver the service. Under the UK GDPR and EU GDPR, customers are entitled to review this list and to object to a new sub-processor on reasonable data-protection grounds before it begins processing their data.
AppDeploy is operated by ScotiTech Solutions Limited, a company registered in Scotland under company number SC829021, ICO registration reference ZB925464.
Last updated: 14 October 2026.
Current sub-processors
| Sub-processor | Service provided | Personal data shared | Jurisdiction |
|---|---|---|---|
| Hostinger | Transactional email — verification, password reset, invites | recipient email and name, and the content of the email | EU (Lithuania) |
| Stripe | Billing and payments | name, email, billing address, tokenised card data (never stored on AppDeploy servers) | UK / EU (Ireland); Stripe may also process data in the United States |
| Apple Distribution International Ltd. | Apple Business API and Apps and Books, when you enable Apple Business | your Apple Business org users: email, Managed Apple ID, group membership | Ireland (EU) |
| Apple Inc. | Apple Push Notification service, when you enrol devices: it tells an enrolled device to check in with AppDeploy, through your workspace's own push certificate | the device's push token and check-in token (no command content) | United States |
| Backblaze B2 (EU) | Encrypted off-server backups. Being set up; no data is sent to it yet | encrypted copies of the database and uploaded files, once in use | EU (Amsterdam) |
Sub-processors marked "when you enable" or "when you enrol devices" are not engaged unless you use the corresponding feature. If you do not, no data is shared with that sub-processor.
Hosting is not a sub-processor: AppDeploy runs on infrastructure that ScotiTech Solutions Limited operates itself in Glasgow, United Kingdom.
Not in use today
The providers below are not switched on and receive no personal data. Before any of them does, we will move it to the list above and give the 30 days' notice described below.
| Provider | Service | Jurisdiction |
|---|---|---|
| PostHog EU (PostHog, Inc., EU cloud) | Product analytics; website analytics would need your cookie opt-in | EU (Frankfurt) |
| Sentry GmbH | Error monitoring | Germany (EU) |
| Cloudflare, Inc. | Turnstile bot protection | Global edge network |
| WorkOS, Inc. | Single sign-on for Enterprise workspaces | United States |
Where your data lives
Personal data is hosted on infrastructure that ScotiTech Solutions Limited operates in Glasgow, United Kingdom. Daily database backups are kept on the same server in Glasgow; encrypted off-server backups in the EU (Backblaze B2) are being set up, and we will update this page when they start. The sub-processors above process the personal data listed against them, in the jurisdictions shown. Some of them, such as Apple and Stripe, may process data outside the UK and the European Economic Area, including in the United States, under the safeguards described in our Privacy Policy.
For more detail on where a particular category of data lives, contact us at info@scotitech.com.
How we manage changes
- We review this list at least quarterly.
- We give at least 30 days' notice before adding or replacing a sub-processor, so you have the opportunity to object on reasonable data-protection grounds.
- If you raise a reasonable objection we cannot resolve, you may terminate the affected part of the service.
- Material changes are announced in the dashboard and emailed to your organisation administrator.
Questions or objections
To raise a question or a data-protection objection about a sub-processor, contact us at info@scotitech.com. This sub-processor list also forms Annex C of our Data Processing Agreement.