Sub-processors
Sub-processors
These companies process personal data for Kapi Works. KAPILEARN LIMITED uses each under a contract with data protection terms that match ours, and stays responsible for them.
When your organisation uses Kapi Works
Your organisation decides how its people's data is used, and Kapi handles it on its behalf. Kapi Works keeps its database in London, United Kingdom.
- Provider
- Supabase Pte. Ltd., Singapore
- What it does
- Stores Kapi Works data: people, training records, certificates, courses and settings, with company logos and profile pictures. Runs sign-in, scheduled jobs and the server functions that send emails and build records downloads.
- Where
- London, United Kingdom, for the database, sign-in and stored images. Supabase does not publish where it keeps backups and logs.
- Transfers
- The UK Addendum to the EU Standard Contractual Clauses in Supabase's data processing terms, for any access from outside the UK.
- Their terms
- Data processing terms
- Provider
- Vercel Inc., United States
- What it does
- Runs Works Studio, Works Learn, the Kapi Works API, this website and the developer docs.
- Where
- Servers in London, United Kingdom. Requests enter Vercel's network at the location nearest the person. Vercel copies backups worldwide and names the United States as its main processing location.
- Transfers
- UK Extension to the EU-US Data Privacy Framework, and the UK Addendum in Vercel's data processing terms.
- Their terms
- Data processing terms
- Provider
- Cloudflare, Inc., United States
- What it does
- Stores files: uploads, course media and records downloads. Runs Kapi's file gateway, which checks every file request.
- Where
- Files in Cloudflare's Western Europe region. The gateway runs at the Cloudflare location nearest the person.
- Transfers
- UK Extension to the EU-US Data Privacy Framework, and the UK Addendum in Cloudflare's data processing terms.
- Their terms
- Data processing terms
- Provider
- Amazon Web Services EMEA SARL, Luxembourg
- What it does
- Amazon SES sends Kapi Works emails: invitations, reminders, sign-in codes and notices to owners and admins.
- Where
- United States (us-east-1).
- Transfers
- The UK International Data Transfer Addendum in AWS's data processing terms.
- Their terms
- Data processing terms
- Provider
- Google Cloud EMEA Limited, Ireland (Gemini API)
- What it does
- When a Works Studio user asks Kapi AI to draft or check a course, Gemini receives the request and the material they upload. It does not receive people's training records. Google does not use these requests to train its models, and keeps them for up to 55 days to detect abuse.
- Where
- Google's infrastructure. Google does not fix a location for this service.
- Transfers
- UK Extension to the EU-US Data Privacy Framework (Google LLC), and the UK Addendum in Google's processor terms.
- Their terms
- Data processing terms
- Provider
- Google Cloud EMEA Limited, Ireland (Google Workspace)
- What it does
- Kapi's mailboxes, including support@kapiworks.com, where support requests arrive.
- Where
- Google's infrastructure, which can be outside the UK.
- Transfers
- UK adequacy regulations for the European Economic Area, and the UK Extension to the EU-US Data Privacy Framework (Google LLC).
- Their terms
- Data processing terms
When you visit this website or send an enquiry
Vercel hosts this website, Supabase stores enquiries in London, Cloudflare Turnstile checks enquiries for spam, Amazon Web Services sends the receipt email and Google Workspace holds the enquiry in our mailbox. For these, KAPILEARN LIMITED decides how the data is used. See our privacy notice.
Changes
We tell organisations that use Kapi Works at least 30 days before we add or replace a sub-processor. We email their owners and admins, say by when they can object, and update this page.
An organisation can object within those 30 days on reasonable data protection grounds, by emailing support@kapiworks.com. We will try to resolve it, for example by not using that provider for the organisation. If we cannot, the organisation can end the affected service before the change takes effect.
If a provider fails or puts data at risk, we may replace it sooner and tell organisations as soon as we can.
To hear about changes, email support@kapiworks.com.
Change log
- 10 October 2026
- List published.
Last updated 10 October 2026.