Third-party service providers used by Paylists to provide, secure, support and improve the Services.
Effective date: 9 May 2026Paylists LTD · Company no. 14081565
This list identifies key third-party service providers and subprocessors used by Paylists LTD to provide, secure, support and improve the Services. Some providers are used only where a user enables the relevant optional feature. DataRep is listed because it supports data protection request handling as Paylists' EU representative; it is not a product support contact.
Paylists currently does not use cookies or cookie-based analytics/advertising providers. If that changes, this list and the Privacy Policy will be updated.
This list does not replace any Data Processing Agreement. Where Paylists acts as a processor for a business user, Paylists requires subprocessors that process personal data for Paylists to be subject to appropriate written data protection terms, which may be included in a DPA, service agreement, online terms or another written agreement.
Subprocessors and third-party service providers
Amazon Web Services (AWS)
Infrastructure
Role
Hosting and server infrastructure supporting Paylists systems and storage.
Data
Account data, business profile data, customer/vendor data, document metadata, logs and other service data hosted in Paylists systems.
Location
London, United Kingdom, according to Paylists' current configuration.
Supabase
Database
Role
Managed PostgreSQL database and related backend services used by Paylists.
Data
Account data, business profile data, customer/vendor data, invoice/payment-request data, authentication-related data and technical data depending on Paylists' configuration.
Location
London, United Kingdom, according to Paylists' current configuration. Supabase uses PostgreSQL managed on AWS infrastructure.
Vercel
Hosting
Role
Application hosting, deployment and delivery platform for the Paylists Next.js and TypeScript application.
Data
Application hosting data, deployment data, technical logs, request metadata and service data processed by the hosted application where applicable.
Location
London, United Kingdom, according to Paylists' current configuration.
Twilio
Communications
Role
Communications services, such as SMS, email, authentication or service notifications where used.
Data
Business contact details, message metadata and content necessary to send service communications.
Location
International provider. Appropriate contractual and transfer safeguards should be maintained where required.
OpenAI API Platform
Optional · AI
Role
Optional AI-assisted cash-flow insights where enabled or consented to by the authorised user.
Data
Minimised and pseudonymised cash-flow data where reasonably possible, such as invoice amount, due date, payment status and random identifiers; AI output.
Location
International provider. Paylists should maintain appropriate contractual and transfer safeguards and avoid sending user, business, customer or vendor names where not required.
Wolters Kluwer Belgium NV / Codabox / Flowin
Peppol Access
Role
Flowin is the e-invoicing product of Codabox used by Paylists to support Peppol onboarding, KYC/proof-of-ownership or authority verification where applicable, Peppol registration and the sending and receiving of e-invoices and credit notes through the Peppol network.
Data
Company number, legal name, registered office address, business contact details, proof of ownership or authority, Peppol identifiers, e-invoice/credit-note data, metadata, delivery status and technical logs.
Location
Belgium / EU provider. Peppol functionality is available only in Flowin Supported Countries and subject to Flowin/Codabox terms and technical availability.
Data Protection Representative Limited (DataRep)
EU Representative
Role
EU representative services and data protection request handling. DataRep may receive and forward data subject or supervisory authority communications to Paylists.
Data
Personal data included in data protection requests, identity verification details where relevant, contact details and related correspondence.
Location
Ireland / EU representative. DataRep is not Paylists' DPO and should be contacted only through the designated DataRep request route.
Processing locations and transfer safeguards
Paylists records the regions and processing locations used by its subprocessors. If a subprocessor changes its processing location or begins processing personal data outside the UK or EEA, Paylists will assess whether updates are needed to this Subprocessor List, the Privacy Policy, the DPA, the ROPA, and any applicable international transfer safeguards.
Change control
Paylists updates this list when it adds, removes or materially changes a subprocessor, including any material change to provider purpose, data categories, country of processing or transfer safeguards. Where required by the DPA or applicable Data Protection Laws, Paylists will provide notice of material subprocessor changes and allow objections on reasonable data-protection grounds.