The third parties we use to deliver services.

The third parties below process data on BaseHost's behalf as part of delivering, supporting and billing our managed IT, hosting and communications services. We publish this list for transparency and to help our clients meet their own compliance obligations.

Each provider is listed with its legal entity, the location from which it operates, the purpose for which we engage it, and the categories of data it may process. Locations indicate where the provider is established; data may be processed in other regions under the provider's own terms.

Cloud infrastructure & hosting

Provider	Legal entity	Location	Purpose of processing	Data categories
Amazon Web Services (AWS)	Amazon Web Services, Inc.	Seattle, Washington, USA	Cloud infrastructure, hosting and DNS	Any customer data stored in hosted environments, typically contact details, business records, account and application data
Vercel	Vercel, Inc.	San Francisco, California, USA	Front-end application hosting and deployment	Application content and end-user interaction data; technical and log data
Supabase	Supabase, Inc.	San Francisco, California, USA	Managed database and backend services	Application and database records, which may include contact and account data
Shopify	Shopify Inc.	Ottawa, Ontario, Canada	Hosted e-commerce platform for client stores we build and manage	Storefront content, product catalogue, order data, end-customer contact details and payment metadata

Security & threat protection

Provider	Legal entity	Location	Purpose of processing	Data categories
DNSFilter	DNSFilter, Inc.	Washington, D.C., USA	DNS-layer content filtering and threat protection	DNS query data, IP addresses, network and device identifiers
Trend Micro	Trend Micro Incorporated	Tokyo, Japan	Endpoint security and threat protection	Device and security telemetry, file and threat metadata, IP addresses
KnowBe4	KnowBe4, Inc.	Florida, USA	Security awareness training and simulated phishing	User name, work email address, training assignment and completion status, simulated-phishing interaction results

Monitoring & systems management

Provider	Legal entity	Location	Purpose of processing	Data categories
N-able	N-able Solutions ULC	Ottawa, Ontario, Canada	Remote monitoring and management of client systems	Device, system and performance telemetry, configuration and asset data, technician and user identifiers
New Relic	New Relic, Inc.	San Francisco, California, USA	Application and infrastructure performance monitoring	Application performance metrics, logs and technical telemetry
StatusCake	StatusCake Limited	London, United Kingdom	Uptime and availability monitoring	Monitored URLs, uptime and response telemetry, technical data

Remote support & development

Provider	Legal entity	Location	Purpose of processing	Data categories
TeamViewer	TeamViewer Germany GmbH	Goppingen, Germany	Remote support and remote access sessions	Device identifiers, session data and screen content shared during support sessions
GitHub	GitHub, Inc.	San Francisco, California, USA	Source code hosting and version control for automation and infrastructure-as-code	Source code, configuration and scripts; contributor identifiers

Payments & billing

Provider	Legal entity	Location	Purpose of processing	Data categories
Stripe	Stripe Payments Australia Pty Ltd	Melbourne, Australia	Card payment processing and recurring billing	Name, billing contact details, payment card data and transaction records
eWAY	Eway Payments Pty Ltd	Sydney, Australia	Payment gateway and card processing	Name, billing contact details, payment card data and transaction records
GoCardless	GoCardless Ltd	London, United Kingdom	Direct debit and recurring payments	Name, bank account details, billing contact details and transaction records
PayPal	PayPal Australia Pty Limited	Sydney, Australia	Payment processing	Name, contact details, payment account identifiers and transaction records

Communications & marketing

Provider	Legal entity	Location	Purpose of processing	Data categories
Twilio	Twilio Inc.	San Francisco, California, USA	SMS and programmable messaging for service notifications	Phone numbers, message content and contact identifiers
Mailchimp	The Rocket Science Group, LLC (d/b/a Mailchimp)	Atlanta, Georgia, USA	Email delivery and subscriber communications	Name, email address and subscriber engagement data

CRM, productivity & business tools

Provider	Legal entity	Location	Purpose of processing	Data categories
HubSpot	HubSpot, Inc.	Cambridge, Massachusetts, USA	CRM and customer relationship management	Name, business contact details, communication history and sales records
Google Workspace	Google LLC	Mountain View, California, USA	Email, productivity and collaboration	Email content, documents, contact details and account data
HaloPSA	Halo Service Solutions Ltd	Stowmarket, United Kingdom	Service desk, ticketing and professional services automation	Contact details, support ticket content, asset and configuration records, billing data
Adobe	Adobe Inc.	San Jose, California, USA	Document and creative software services	Documents and files processed in Adobe applications; account data

AI & automation

Provider	Legal entity	Location	Purpose of processing	Data categories
OpenAI	OpenAI, L.L.C.	San Francisco, California, USA	AI-assisted service tooling and automation	Text inputs submitted for processing, which may include support content and technical data
Anthropic	Anthropic, PBC	San Francisco, California, USA	AI-assisted service tooling and automation	Text inputs submitted for processing, which may include support content and technical data

App distribution

Provider	Legal entity	Location	Purpose of processing	Data categories
Google Play	Google LLC	Mountain View, California, USA	Android application distribution	Application metadata and end-user install and usage data as governed by the platform
Apple App Store	Apple Pty Limited	Sydney, Australia	iOS application distribution	Application metadata and end-user install and usage data as governed by the platform

Notification of changes

When a new material subprocessor is added, or an existing one is replaced, we notify managed clients in writing at least 30 days before the change takes effect. Clients may object to a new subprocessor on legitimate grounds, in which case we'll discuss alternative arrangements.

Subscribe to updates

Want to know whenever this list changes? Join our dedicated subprocessor notification list. It is used only to send notices about updates to this page, never for marketing.

Double opt-in: we'll email you a confirmation link, you are not added to the list until you click it. We never sell or share your details. See our Privacy Policy.