Sub-processors
Last updated 11 November 2026
CoreFi is a trading name of JG Core Ltd (company 16218779, England and Wales). These are the providers that process personal data on our behalf, what each does for us, the data it handles and where. For how we use personal data and your rights, see our privacy notice. Where data goes outside the UK, the safeguards described in the privacy notice apply.
| Provider | What it does for us | Personal data | Where |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in and private file storage | Account, case and borrower records; uploaded documents | UK (AWS London, eu-west-2) |
| Vercel Inc. | Hosts the website and runs the application | Requests to the site and app | Application code runs in London; pages are served from Vercel's global network |
| Amazon Web Services (Amazon SES) | Sends email | Names, email addresses, email content | UK (London, eu-west-2) |
| Zoho Corporation (Zoho Mail) | Our mailbox, including email to lenders | Email correspondence and attachments | Zoho's EU data centre |
| Forward Email LLC | Receives email sent to corefi.app addresses and forwards it to us | Incoming email | USA |
| Resend, Inc. | Sends some service email | Email addresses, email content | USA (us-east-1) |
| TrueLayer Limited | Read-only Open Banking connections | Bank account and transaction data, where you connect a bank | UK |
| Stripe | Card payments | Payment and billing details | UK, EU and USA |
| Google (Google Analytics) | Website analytics, only if you accept analytics cookies | Pseudonymous usage data | USA and other Google locations |
| Southern Vector Limited (MillionVerifier) | Checks a business email address can receive mail before our first email to it | Business email addresses | New Zealand, Hungary, the EEA and the USA (per its privacy policy) |
| Hetzner Online GmbH | JG Core's own server for public-register data | Company and officer data from public registers; our email history | Finland (Helsinki) |
| Cloudflare, Inc. (R2) | Encrypted backups of that server | As above, encrypted | EU jurisdiction |
Changes
We give at least 30 days' notice before adding or replacing a sub-processor: on this page, and by email or dashboard announcement to partners under the Partner Data Processing Addendum. If you object on reasonable data protection grounds, email hello@corefi.app.
Contact
Questions about this list: hello@corefi.app. See also security for brokers, lenders and borrowers.