# Business Made Simpler suppliers

Last updated: 21 October 2026

Document version: 2026-10-21

This list explains the principal suppliers used to operate the referral platform. A supplier's role depends on the information and service concerned. BMS retains detailed agreements and transfer evidence privately. A UK or EU server region does not guarantee that provider support or all processing occurs only there.

## Customer content suppliers

| Supplier | Service and information | Processing locations and safeguards |
| --- | --- | --- |
| Render | Application, database, stored documents, operational logs and backups. May process customer content and account information. | Primary app/database hosting selected in Frankfurt, Germany; provider operations and subprocessors may involve the US and other locations. Applicable DPA and UK transfer safeguards must cover restricted transfers. |
| SMTP2GO operated by Sand Dune Mail Limited | Transactional invitations, agreement messages, password resets and service notifications, including recipient details and message content. | EU-hosted BMS account; provider processing and support may involve New Zealand, the US and other approved locations. BMS recorded acceptance of the provider DPA and UK transfer terms on 17 October 2026. |
| Microsoft 365 | Business email and support correspondence; may receive customer content supplied in support requests. | The account agreement identifies Microsoft Ireland Operations Limited. Main relevant workloads show UK current/committed data-at-rest storage; this does not cover every processing or support location. The agreement incorporates Microsoft's DPA. BMS is completing the record of the applicable DPA edition, transfer arrangements and mailbox retention settings; this entry is not a claim that those checks are complete. |

## Billing and other service providers

Stripe provides subscriptions, payment processing and fraud prevention. It can act as an independent controller for its own regulated, fraud and other purposes and as processor for certain services under its DPA. Card details are entered directly into Stripe. Processing can involve the UK, EEA and international Stripe providers.

GitHub hosts source code and deployment metadata. It is not an intended store of customer production data and is not listed as a customer-content subprocessor for that purpose.

Xero is a planned integration. It must remain disabled for customers until its provider review, disclosures and safeguards are complete. Listing it here does not authorise processing through it.

## Changes and enquiries

BMS will notify customers of intended additions or replacements of customer-content subprocessors and provide a meaningful opportunity to object before processing begins, under the Customer Terms and DPA. Routine notice is at least 30 days. Urgent changes do not remove the need for lawful authorisation and an opportunity to object.

For questions, the current supplier details or copies of applicable transfer safeguards, contact sarah@businessmadesimpler.co.uk. Copies may be redacted to protect confidential information. BMS must verify the applicable safeguard and any required assessment; this list is not a substitute for that evidence.