A sub-processor is a third party we engage to process personal data on our instructions so that we can provide the Platform. Each one is under a written contract that limits its use of the data to providing its service to us, and applies confidentiality and security obligations at least as protective as our own. This page is the register referred to in section 6 of our Privacy Policy.
1. Current sub-processors
Link to section 1. Current sub-processors| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services | Hosting for the application, the database, and document storage. All customer content uploaded to a workspace is stored here. | All customer content, account and identity data, and security and audit logs. | Australia, Singapore, United Kingdom, United States |
| Amazon Web Services (Bedrock) | The AI models behind the in-product assistant and AI-assisted document drafting. | The content and prompts submitted to an AI feature at the moment it runs. Not used to train the provider's models. | Australia, Singapore, United Kingdom, United States |
| Microsoft (Azure AI Foundry) | AI models used for document embeddings, which make uploaded sources searchable, and for document generation. | The content and prompts submitted to an AI feature at the moment it runs. Not used to train the provider's models. | Australia, Singapore, United Kingdom, United States |
| Cloudflare | Delivery of the web application and the company website, the bot check on the website's demo-request, contact and subscription forms, storage of demo requests, of contact enquiries and of subscriptions to updates to this register, the email that tells our team a demo request or contact enquiry has arrived, and the emails sent to people who subscribe to updates to this register. | Connection data in transit — IP address, request metadata. For a demo request, the name, work email, organisation and message you submit. For a contact enquiry, the name, work email, organisation, topic and message you submit. For a subscription to updates to this register, your email address, and a hashed form of your IP address kept for up to two hours. No customer content is stored here. | Global edge network; demo requests, contact enquiries and subscriptions are stored in the European Union |
| Sentry | Application error and performance monitoring, so we can detect and fix faults. | Diagnostic telemetry. Authentication cookies, tokens and workspace identifiers are stripped before sending, but an error report can still incidentally contain personal data. | United States |
| Resend | Delivery of transactional email — workspace invitations, password resets, and notifications. | Recipient name and email address, and the content of the message. | United States |
| Microsoft 365 | The mailboxes that receive and answer support and security correspondence. | Whatever you include when you contact us, and your contact details. | European Union |
| Firecrawl | Retrieval of publicly published regulatory sources — legislation, guidance, authority publications — into the platform's own reference library. | None. Public regulatory sources only; no customer content is sent. | United States |
Location lists the countries in which a provider may process data for us. It is not a specific data centre, and naming a country does not mean data is held there at any given time.
2. International transfers
Link to section 2. International transfersEcoSphere Intelligence Limited is an Irish company. The providers above may process personal data in countries outside the EEA and the United Kingdom, including the United States, so providing the Platform involves international transfers of personal data.
Where we transfer personal data outside the EEA or the UK to a country without an adequacy decision, we rely on appropriate safeguards under EU and UK GDPR Chapter V — principally the European Commission's Standard Contractual Clauses for EEA data and the UK International Data Transfer Addendum for UK data, supplemented by technical and organisational measures. You may request a copy of the relevant safeguards using the contact details below.
3. Changes to this list
Link to section 3. Changes to this listWe update this register when our sub-processors change, and record every revision below. If your organisation has a Data Processing Agreement with us, the notice period and objection rights for a new sub-processor are set out there.
Version 1.3.0 — 15 October 2026
- Extended Cloudflare's entry to the website's contact form: its bot check, storage of enquiries in the European Union, and the notification email to our team.
Version 1.2.0 — 15 October 2026
- Extended Cloudflare's entry to email updates about this register: the bot check on the subscription form, storage of subscriptions in the European Union, and the confirmation and update emails sent to subscribers.
Version 1.1.0 — 15 October 2026
- Extended Cloudflare's entry to the company website at ecosphere-intelligence.com: its bot check on the demo-request form, storage of demo requests in the European Union, and the notification email those requests send to our team.
Version 1.0.0 — 29 July 2026
- First publication of the register as a standalone page. It previously existed only as a table inside section 6 of the privacy policy.
- Added Amazon Web Services (Bedrock) and Microsoft (Azure AI Foundry) as the AI model providers actually in use.
- Removed OpenAI and Anthropic as direct providers. They are reachable only where a workspace configures its own account with them.
- Removed Fly.io and Cloudflare R2, both decommissioned, and Stripe, which is not in use.
- Corrected the locations, which named the wrong hosting region.
Email updates
Get an email when we change this register.
We first send a link to confirm your address. After that, you get an email describing each change to this register, and only when the register changes. Each email has a link to unsubscribe, which deletes your address. Our Privacy Policy explains how we handle it.
The same changes are in an Atom feed for feed readers.
4. How to contact us
Link to section 4. How to contact usQuestions about this register, or a request for the transfer safeguards behind any row, go to privacy@ecosphere-intelligence.com.