ValarIQ

Legal

Subprocessors

Effective date: 2026-10-07 · Last reviewed: 2026-10-07

ValarIQ is a trading name of Keston Group Ltd.

1. Introduction

Keston Group Ltd, a company registered in England and Wales under company number 17300417, whose registered office is at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. ValarIQ is a trading name of Keston Group Ltd.

This page lists providers that process personal data on behalf of Keston Group Ltd in connection with ValarIQ, based on verified operational configuration. It does not create a certification, partnership endorsement or contractual commitment beyond the applicable customer agreement and DPA.

Last reviewed: 2026-10-07.

2. Controller and processor roles

Keston Group Ltd is normally the controller for its website, account administration, commercial contacts, security operations and service communications. For customer-submitted platform content, Keston Group Ltd may act as a processor on the customer’s documented instructions. Exact roles must be governed by the customer agreement and DPA.

3. A — Current production subprocessors

Railway Corp

  • Purpose: Application hosting, compute and managed database hosting for the ValarIQ service.
  • Data / scope: Customer workspace content and metadata processed by the platform (accounts, decisions, evidence, logs) as stored and computed by the application.
  • Location status: Railway-hosted infrastructure in the provider’s operated regions.
  • Transfer status: Where processing involves an international transfer, appropriate transfer safeguards under Railway’s applicable customer terms are relied upon.
  • Provider information: Privacy / security information
  • Added / last reviewed: 2026-10-07

Cloudflare, Inc.

  • Purpose: DNS for valariq.com and Email Routing for the public contact mailbox.
  • Data / scope: DNS query metadata; email routing metadata and message content in transit for addresses configured for Email Routing (for example the public contact mailbox).
  • Location status: Cloudflare global edge network.
  • Transfer status: Where Cloudflare processing involves an international transfer, appropriate safeguards under Cloudflare’s applicable customer terms are relied upon.
  • Provider information: Privacy / security information
  • Added / last reviewed: 2026-10-07

Resend, Inc.

  • Purpose: Transactional email delivery (invitations, one-time codes, demo enquiries and similar service messages) when configured.
  • Data / scope: Recipient email address, message metadata and message content required to deliver transactional mail.
  • Location status: Resend-hosted email infrastructure.
  • Transfer status: Where Resend processing involves an international transfer, appropriate safeguards under Resend’s applicable customer terms are relied upon.
  • Provider information: Privacy / security information
  • Added / last reviewed: 2026-10-07

External uptime monitoring provider (operator-managed)

  • Purpose: External availability checks against the public health endpoint.
  • Data / scope: Technical availability signals for the monitored URL. Not used to process customer workspace content.
  • Location status: Operator-managed monitoring account.
  • Transfer status: Limited technical metadata; transfer terms follow the monitoring provider’s agreement.
  • Provider information: Contact ValarIQ
  • Added / last reviewed: 2026-10-07

4. B — Conditional or unused providers

  • Microsoft 365 / SMTP. Unused SMTP fallback while Resend is configured for transactional mail. Not a current production subprocessor while unused.

5. C — Optional product integrations (not current subprocessors)

  • Stripe (customer payment rails / future ValarIQ billing). Customer payment execution remains in the customer stack. ValarIQ billing collection is not active as a production payment processor for ValarIQ subscriptions. Not listed as a current ValarIQ subprocessor.
  • Customer identity providers (OIDC / SSO). Customer-controlled IdPs authenticate users when SSO is activated for an organisation. Customer-activated; the IdP is not a ValarIQ subprocessor merely because an adapter exists.
  • Scanners, API gateways, SIEM, ticketing and similar connectors. Optional discovery or integration adapters (for example scanners, MuleSoft, Kong). Not current ValarIQ subprocessors until a customer activates a specific integration under contract.

6. Changes and customer contact

We intend to notify customers of material subprocessor changes in line with the applicable customer agreement and DPA. Until that contractual mechanism is finalised, customers may request the current list and raise diligence questions via hello@valariq.com or privacy enquiries via privacy@valariq.com.