DRAFT — not approved for public service use
Version: 2026-09-18.6
Effective: 2026-09-18

# Provider and Location Register

This register identifies relevant service arrangements for **Free S3**, operated by Backends. Read it with the [Privacy Notice](/legal/privacy) and [Data Processing Agreement](/legal/data-processing).

## 1. Our infrastructure and locations

| Function | Verified arrangement |
| --- | --- |
| Legal operator | Backends; registered in England and Wales. |
| Portal and account database | Backends - United Kingdom; processing location: Enderby, United Kingdom. |
| Object-storage server | Backends - United Kingdom; processing location: Enderby, United Kingdom. |
| Backups/snapshots | Backends - United Kingdom; locations: Enderby, United Kingdom; retention: Daily backups retained 30 days; monthly restore tests; deletion reapplied after restore. |
| Remote operator access | Kegworth, United Kingdom and Enderby, United Kingdom. |
| Transactional email/support mailbox | Backends - United Kingdom. |
| Public gateway, DNS/CDN and security providers | Cloudflare, Inc. - Turnstile; YDNS.io - DNS; OpenPanel AB - analytics SDK distribution from openpanel.dev. |
| Monitoring and support tools | Backends - self-hosted OpenPanel analytics in the United Kingdom; OpenPanel AB - browser SDK distribution. |
| Turnstile | Enabled: Cloudflare, Inc., bot/security challenge service for portal registration.. |

Software operated on infrastructure controlled by the operator is not, merely by being installed, a separate recipient of customer data. An external host, administrator, gateway, backup provider or support provider that can access personal data is a separate question.

Optional portal analytics is sent only after a separate choice to the self-hosted OpenPanel API operated by Backends. OpenPanel AB distributes the browser SDK from `openpanel.dev` and may receive ordinary download request metadata. Session replay is disabled and these analytics arrangements do not grant access to customer objects.

## 2. Authorised sub-processors for customer data

The following verified register is the list authorised under the DPA. It must specify each legal entity, function, data access/categories, processing and support countries, and transfer safeguard. Where the operator uses only its own infrastructure and personnel for customer objects, the register must say that explicitly and identify any external party with possible access; it must not silently infer "none" from self-hosting.

**Backends - United Kingdom UK GDPR Contract**

Providers that process only account/security information for our Controller purposes are identified separately below; they are not treated as having authority to inspect Customer objects by default.

**Cloudflare, Inc. - anti-abuse signals; Backends - account email delivery and self-hosted portal analytics; OpenPanel AB - analytics SDK distribution**

## 3. Cloudflare Turnstile and optional gateways

Registration uses Cloudflare Turnstile. Your browser contacts Cloudflare for a security challenge. Technical/device signals and an IP address may be processed; our server also sends your IP with the token for verification. This is used to resist automated abuse, not to inspect customer objects. Cloudflare's [Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/) describes its processor role for protecting a site and its separate controller role for improving bot detection. Assess those roles and data flows against the operator's contract and configuration.

Turnstile does not by itself mean that Cloudflare hosts Customer objects. Conversely, putting the S3 or portal hostname behind a Cloudflare or other gateway can create additional processing/access which must be listed above. Provider documentation and use of a UK server alone do not establish a UK-only data residency promise.

## 4. Transfers, updates and questions

The verified international-transfer arrangements are **UK adequacy regulations where applicable; UK IDTA/Addendum and transfer assessment where required**. Where a mechanism requires completed contractual schedules or an assessment, these must be in place; this register is not a substitute.

We give Customer Data sub-processor change notices and an opportunity to object under the DPA, normally at least 30 days before the new processing. A material location/provider change is assessed before deployment and reflected in this register. Ask privacy@backends.co.uk for details, safeguard information or to raise a reasonable data-protection objection.