Data processing

Last updated 25 August 2026

Subprocessors

Amazon Web Services EMEA SARL

Hosting, storage, transactional email — eu-west-2 (London)

This list will grow as the product does (payments: Stripe; document extraction: Anthropic) — each addition appears here before it processes any customer data, with its role and region.

Security measures

• Inverter credentials are envelope-encrypted with a dedicated AWS KMS key before storage and decrypted only inside the collection service. No API returns them.
• Secrets never appear in logs, error messages, client bundles, or analytics events.
• All data in transit is TLS; all data at rest is encrypted.
• Access to production is limited to the operator, via short-lived SSO credentials.

Data processing agreement

Suntide serves households, so most customers don't need a signed DPA. If you're a business customer who does, email hello@suntide.energy and we'll put our standard agreement (UK GDPR art. 28 terms, incorporating this subprocessor list) in place.