Sub-processors
Effective 26 October 2026
Contents
This page lists the companies that RouteZero Ltd ("RouteZero", "we", "us") uses to process customer travel data on our behalf. For each company, it sets out what we use it for, where the data is stored, and the safeguards that apply if the data leaves the UK.
1. Who this applies to
We publish this list for any organisation ("you") that shares travel data with us under an agreement for our services.
This list covers the data you share with us under our agreement. It doesn't cover other personal data we hold, such as your contact details or visits to our website. Our privacy policy covers the personal data of website visitors, people who contact us, and contacts at our customers.
2. What a sub-processor is
When you share your travel data with us, we process it on your behalf. To process data means to do anything with it, such as storing, reading, or analysing it. A sub-processor is another company that processes that data for us, on our instructions.
3. How we choose them
Before a company processes your data, we check how it protects data, including its independent security certifications. Each company on this list:
- holds ISO 27001 certification and SOC 2 reports,
- acts as a processor of your data, meaning it processes the data on our behalf and on our documented instructions, and
- is bound by a written data processing agreement that sets out how it must protect your data.
4. Our sub-processors
| Company | What we use it for | Where your data is stored |
|---|---|---|
| Microsoft | Storing your files and receiving data you email us. | United Kingdom. |
| Anthropic | AI that helps us set up and check how we process your data. | United States. |
5. Microsoft
| Service | Microsoft 365: SharePoint and Outlook. |
| What we use it for | You have a private SharePoint site, which holds the primary copy of your data. Outlook receives data you choose to email us. |
| Where your data is stored | United Kingdom. Microsoft commits to storing our SharePoint files and Outlook mailboxes in the UK, because our Microsoft 365 account is set up in the UK. |
| Where it may be processed | Microsoft may transfer data outside the UK to provide the service. |
| Safeguard for transfers | The 2021 EU Standard Contractual Clauses and the UK International Data Transfer Addendum, in Microsoft's Data Protection Addendum. |
| Sources | Microsoft 365 data residency in the Product Terms, Microsoft Products and Services Data Protection Addendum, Microsoft 365 ISO 27001 certification, Microsoft 365 SOC 2 reports. |
6. Anthropic
| Service | Claude, through Claude Code, on a Team plan under Anthropic's Commercial Terms. |
| What we use it for | AI that helps us set up and check how we process your data, while we import your data and develop our processing. Before Claude sees your data, our tooling replaces names and other identifying details with pseudonyms, or removes them. A team member chooses, for each column of your data, whether Claude sees it as written, sees only part of it, sees a pseudonym, or doesn't see it at all. |
| Where your data is stored | United States. |
| Where it may be processed | The United States, Europe, Asia, or Australia. Anthropic may also process data for support and safety review in countries where Anthropic or its affiliates operate. |
| Safeguard for transfers | The EU Standard Contractual Clauses and the UK International Data Transfer Addendum, in Anthropic's Data Processing Addendum. Anthropic's Data Processing Addendum forms part of its Commercial Terms. |
| Sources | Where Anthropic's servers are located, Anthropic's Data Processing Addendum, Anthropic's Commercial Terms, Anthropic's certifications. |
7. International transfers
The primary copy of your data is stored in the UK, in Microsoft SharePoint. Your data leaves the UK when we use Anthropic's Claude, which stores data in the United States. Microsoft may also transfer data outside the UK to provide its service.
Each of these transfers is covered by the EU Standard Contractual Clauses with the UK International Data Transfer Addendum. These are standard safeguards the UK GDPR recognises for sending personal data outside the UK.