Wayfinder · legal
Who helps run Wayfinder
These are the companies (Whitelabel AI Corporation’s sub-processors) involved in running the Wayfinder service, what each one does, and the safeguard that applies. This list matches Annex C of the Wayfinder Data Processing Agreement exactly. Offices receive at least 14 days’ written notice before anything on this list changes.
OpenAI
- What it does
- AI language processing: understanding resident messages, routing, classification, safeguarding checks, and framing responses from approved content. The only AI provider used.
- Where
- European Union (EU API endpoint, eu.api.openai.com; no storage)
- Safeguard
- EU-region processing (covered by UK adequacy regulations). Storage disabled on every request: nothing is stored after the response and nothing is used to train AI; data processed transiently per request only.
Amazon Web Services (AWS ECS)
- What it does
- Application hosting
- Where
- United Kingdom (AWS eu-west-2, London)
- Safeguard
- UK region pinned; encryption in transit; processing under the AWS GDPR Data Processing Addendum.
Amazon Web Services (AWS RDS)
- What it does
- Database: all resident data — messages, case details, safeguarding information, contact details — at rest in a dedicated encrypted database
- Where
- United Kingdom (AWS eu-west-2, London)
- Safeguard
- UK region; encryption at rest; backups kept in the UK; resident message content excluded from system logs; processing under the AWS GDPR Data Processing Addendum.
AgentMail, Inc.
- What it does
- Transactional email (follow-ups and reminders the resident requests)
- Where
- United States
- Safeguard
- UK Addendum / IDTA. The resident's email address and the content of the email they asked for pass through US servers only when an email is sent — the one disclosure of resident data outside the UK-storage/transient-AI pattern.
PostHog, Inc.
- What it does
- Product analytics
- Where
- European Union (PostHog EU Cloud)
- Safeguard
- EU-hosted event storage, enforced in code (analytics disabled unless the EU endpoint is configured); pseudonymised events only; no resident message content in analytics.
postcodes.io
- What it does
- Postcode-to-area lookup
- Where
- United Kingdom
- Safeguard
- Receives postcode only; no other personal data.
Data protection questions: Whitelabel AI Corporation’s UK representative (Article 27 UK GDPR) is Euverify Ltd (UK), gdpr@euverify.com. This page is versioned with the DPA.