Trust centre
DocumentMS sub-processors
A sub-processor is a third party we engage to process your data on our behalf. This page lists every one we use, what it does, the country it processes in, and the safeguard relied on for any international transfer, along with how much notice you get before the list changes.
What a sub-processor is
A sub-processor is a third party we engage to process customer data on your behalf — hosting, infrastructure, support tooling, or any service that touches your documents or the personal data inside them. Under the GDPR we remain liable for their performance, and we must give you notice before the list changes so you have the opportunity to object.
A vendor that will not publish this list is asking you to accept an unknown supply chain. Publishing it is the minimum, and keeping it accurate is the actual commitment.
Current sub-processors
| Sub-processor | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Application hosting and platform-managed document storage | Documents, metadata, audit records | The platform region selected at provisioning: Ireland, Frankfurt, N. Virginia, Cape Town or Singapore | Standard Contractual Clauses and UK IDTA; EEA and UK regions rely on local processing |
| Postmark (ActiveCampaign, LLC) | Transactional email — notifications, signature requests, password resets | Names, email addresses, notification content | United States, with an EU processing option available on request | Standard Contractual Clauses and UK IDTA |
| Amazon Textract (Amazon Web Services, Inc.) | Optical character recognition, performed in the tenant’s platform region | Document content submitted for processing | The platform region selected at provisioning | Standard Contractual Clauses and UK IDTA; no transfer where the region is in the EEA or UK |
| Anthropic, PBC | AI classification, extraction and summarisation, under zero-retention terms with no training use | Document content submitted to an AI feature by a user | United States | Standard Contractual Clauses and UK IDTA |
| Functional Software, Inc. (Sentry) | Application error and performance monitoring | Technical diagnostics; may incidentally include identifiers | United States | Standard Contractual Clauses and UK IDTA |
| Intercom, Inc. | Customer support ticketing | Contact details and the content of support requests | United States, with EU data residency enabled for EEA and UK customers | Standard Contractual Clauses and UK IDTA |
How changes are notified
- We give 30 days’ notice before a new sub-processor begins processing customer data
- Notice is given both by email to your nominated contacts and by updating this page, so you are not relying on an inbox rule to catch it
- You may object within those 30 days on reasonable data protection grounds. If we cannot offer an alternative that meets the objection, you may terminate the affected part of the service without penalty and take a pro-rata refund
- This page is the authoritative list; the data processing addendum incorporates it by reference
Where your own storage changes the picture
On the Enterprise tier, documents can be stored in your own Amazon S3 bucket or Azure Blob Storage container. In that arrangement the storage provider is your sub-processor rather than ours, the region is yours to choose, and the encryption keys, bucket policy and access logging stay in your account.
That materially shortens the list above for the documents themselves. It does not remove sub-processors handling metadata, search indexing, email delivery or AI processing, and any residency commitment should state explicitly which of those follow the document region — that exception is where most residency claims turn out to be qualified.
最終レビュー: 2026-09-01