Leading Crew & Fleet Management Software
Sub-Processor List
Last updated: 16 April 2026
CrewSmart uses a number of trusted third-party providers ("sub-processors") to help us deliver our services. These providers support infrastructure, communications, customer support, and optional integrations.
We carefully assess all sub-processors and ensure they are subject to appropriate contractual, confidentiality, security and data protection obligations in line with applicable data protection laws, including the UK GDPR.
How We Use Sub-Processors
We use sub-processors to:
- Host and operate the CrewSmart platform
- Deliver system communications such as emails and notifications
- Provide customer support and related documentation
- Enable optional integrations requested or configured by customers
- Provide supporting services such as address lookup, weather or company verification data
Where integrations are optional, they are only used when enabled or requested by the customer.
Infrastructure & Hosting
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Object storage (S3), CDN (CloudFront), email relay (SES), serverless processing (Lambda) | Files/documents, account data, operational metadata, email metadata | EU-West-2 / UK |
Communications & Notifications
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| SendGrid | SMTP email delivery | Recipient email addresses, email content/metadata | EU |
Identity & Authentication
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Microsoft (Azure AD) | SSO / identity federation (SAML) | Authentication attributes, identity claims | Varies |
Analytics
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Analytics | Website analytics/cookies | Usage data, cookie identifiers, page/navigation events | Varies |
Support & Operations
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Atlassian (Jira Service Management / Confluence) | Support tickets and knowledge-base integration | Support request metadata, user account details, ticket content | Varies |
Customer-Enabled Integrations
The following providers are only used where enabled or requested by the customer.
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Xero | Accounting integration (OAuth + accounting APIs) | Contact, purchase order, and accounting-linked metadata | Customer dependent |
| EdApp | Training LMS sync, analytics and webhooks | User identifiers, course completion and progress metadata | Australia / United States |
| Cezanne HR | HR absence/event sync | Employee identifiers and absence event metadata | Customer dependent |
| AST Reygar API | Vessel/report archive retrieval | Vessel/report metadata and report payloads | Customer dependent |
Data Enrichment & External APIs
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Maps Platform | Address lookup, geocoding/reverse geocoding, places autocomplete, map rendering | Address input/query data, coordinates and place metadata | Varies |
| GeoPlugin | IP geolocation lookup | IP address and coarse location metadata | Varies |
| UK Companies House API | Company search/verification | Company data queries | UK |
| Fixer / data.fixer.io | Currency exchange-rate lookups | Currency pair query metadata | Varies |
| UK Trade Tariff API | Commodity code search | Query metadata | UK |
| Stormglass API | Weather/tide data enrichment | Location query coordinates and request metadata | Customer dependent |
| OpenAI API | AI-assisted content generation workflows | Prompt content and generated response content | Varies |
Changes to Sub-Processors
We may update this sub-processor list from time to time as our services evolve.
Where required under our contractual commitments, we will provide advance notice of any material changes to our sub-processors and allow customers the opportunity to raise objections on reasonable data protection grounds.
Data Protection Safeguards
All sub-processors are subject to appropriate contractual controls designed to ensure that:
- Personal data is processed only on authorised instructions
- Appropriate technical and organisational security measures are in place
- Confidentiality is maintained
- Applicable data protection obligations are flowed down where required
- Data subject rights and incident handling obligations are supported
Contact Us
If you have any questions about our use of sub-processors, please contact us at support@crewsmart.co.uk.