Sub-processors
Register approved: 25 August 2026
TriageFit is operated by TriageMethod Ltd, a company registered in Ireland. To run the Service we use the sub-processors below. Each one appears here because a production code path uses it, and each entry states where the processing runs no more firmly than we can enforce or verify: where a region is pinned in our code or configuration, the table says so, and where a provider operates globally, the table says that instead.
This is the current list referenced by our data processing agreement. When we engage a new sub-processor or materially change what an existing one does for us, we update this page and give organisation billing contacts notice by email before the change takes effect, as the agreement sets out.
| Sub-processor | What it does | Where it runs |
|---|---|---|
| Google Cloud (Vertex AI) | Runs the AI models behind the coaching itself: replies, programme adjustments and retrieval over our own knowledge base. The member context sent for a reply can include health data the member has shared with their coach. | EU only. The application refuses to start an AI request against a non-EU region. |
| Neon | Hosts the PostgreSQL database holding accounts, coaching records, billing references and organisation rosters. | EU (Frankfurt). |
| Vercel | Hosts and runs the application, its server-side routes and its scheduled jobs. | Application compute is pinned to Frankfurt. |
| Stripe | Processes payments: checkout, subscriptions, invoices, refunds and payouts. Card details are entered with Stripe and are never stored by TriageFit. | Global provider; no single processing region is pinned. |
| Resend | Delivers the Service's email, including seat invitations, billing notices and coaching messages. | Global provider; no single processing region is pinned. |
| Upstash | Holds rate-limit counters and short-lived payment-webhook idempotency keys. No coaching or health content is stored there. | EU (Frankfurt). |
| Sentry | Receives error telemetry for monitoring and alerting, scrubbed of known identifying and health fields before it leaves the application. Session replay is disabled. | EU (Germany). |
| Cloudflare R2 | Stores files members upload, such as progress photos, wearable exports and documents. | EU jurisdiction. |
| Google (Google Analytics 4 and Search Console) | Consent-gated website analytics with IP anonymisation, and site-level search performance reporting for the administrator. | Global provider; no single processing region is pinned. |
Questions
For anything this page does not answer, including a diligence questionnaire your organisation needs completed, write to info@triagemethod.com. The rest of the procurement pack lives at security and data flows.