Skip to main content
Firearms Records

Supplier transparency

Subprocessors and service providers

Firearms Records uses a focused group of providers to deliver infrastructure, security, routing, storage, backups, email, and payments. Core customer data and backups are stored in the United Kingdom; globally routed technical metadata and payment data have the narrower exceptions described below.

Infrastructure subprocessor

Amazon Web Services (AWS)

Purpose
Storage, backups, and transactional email delivery.
Information involved
Core customer records and backups where those services are used, plus the technical metadata needed to deliver and operate the services.
Location context
Core customer data and backups are stored in the United Kingdom. Limited service, support, or delivery metadata may be processed under AWS international arrangements.

Security and routing provider

Cloudflare

Purpose
DNS, content delivery, web application firewall, managed challenges, rate limiting, routing, availability, and performance monitoring.
Information involved
IP addresses, request and routing information, security signals, challenge data, and technical performance metadata. Cloudflare is not used as the system of record for core customer records.
Location context
Cloudflare operates a global network, so technical traffic and security metadata may be processed outside the United Kingdom.

Payment provider

Stripe

Purpose
Checkout, card and Direct Debit processing, billing, fraud prevention, refunds, and payment administration where payment functionality is used.
Information involved
Billing contacts, payment-session information, transaction metadata, payment method details, and fraud-prevention signals. Firearms Records does not store full card numbers on its own systems.
Location context
Stripe processes payment data under its own infrastructure and international transfer arrangements. For some regulated payment activities, Stripe may act as an independent controller rather than only as a subprocessor.

Customer data residency

The UK-residency commitment applies to core customer records and backups held by Firearms Records. It does not mean that ordinary internet-routing metadata, security signals, or payment-provider data never pass through a supplier’s international systems.

Changes to providers

This page will be updated when a material provider is added, removed, or assigned a materially different processing role. Contracting organisations may request further supplier information as part of due diligence or a data processing agreement.

Read the full data-handling context

The Privacy Policy explains controller and processor roles, sharing, international safeguards, retention, and individual rights in more detail.

Read the Privacy PolicyLegal hub