Skip to main content
LawFuzeICO registered
For SolicitorsMethodologyTrustPricing
Sign inRequest access→

UK GDPR · Article 28

Sub-processor register

Every processor LawFuze relies on to deliver the service, the region your data is processed in, and the lawful transfer mechanism we rely on where data leaves the UK or EEA. We notify customers via this page at least 30 days before onboarding any new sub-processor that handles personal data.

Last updated: 17 May 2026·Next review: Monthly during Phase 1

Current register

Sub-processorRoleRegionTransfer basisStatus
Microsoft AzurePrimary cloud (compute, Postgres Flexible Server, Blob Storage, Key Vault)UK South (London)UK only — no transferLive
Anthropic PBCPrimary LLM inference (Claude family)EU (Frankfurt) — endpoint requestedArt 46 IDTA pendingOnboarding
Azure OpenAISecondary / fallback LLM inference (GPT family)UK SouthUK only — no transferLive
OpenAI L.L.C. (direct API)Fallback only; embeddings + entity extractionUSArt 46 IDTA + TRA pendingOnboarding
CohereRe-ranking of retrieval results (Phase 2)EU / CanadaArt 46 IDTA pendingPhase 2
Stripe Payments UK LtdCard payments + subscription billing (Phase 2)UK / EU / US (segregated)Art 46 IDTA pending (Phase 2)Phase 2
GoCardless LtdDirect debit billing for UK firms (Phase 2)UKUK onlyPhase 2
Twilio Ireland LtdVideo consultations (WebRTC, recording, transcription)EU / USArt 46 IDTA pendingOnboarding
Deepgram, Inc.Speech-to-text for video / audio (Phase 2)USArt 46 IDTA + TRA pending (Phase 2)Phase 2
ResendTransactional email (sign-up, security alerts, billing)EU / USArt 46 IDTA pendingOnboarding
Zoho CorporationEmail mailboxes (founders@, dpo@, legal@, billing@, privacy@, security@)EUAdequacyLive
Cloudflare, Inc.DNS, WAF, CDN, DDoS mitigationGlobal (UK PoP for cache)Art 46 IDTA pendingLive
Sentry (Functional Software)Error monitoring (PII-scrubbed)EUAdequacyLive
Weaviate / pgvector (self-hosted on Azure)Vector embeddings storeUK SouthUK onlyLive

What status means

  • Live — actively processes production data; DPA in place where required.
  • Onboarding — service is wired in but IDTA/DPA counter-signature is still in flight. Personal data flow is gated on the document being executed.
  • Phase 2 — listed for transparency but not enabled until public launch on 1 September 2026.

Notice of changes

We will publish a notice on this page at least 30 calendar days before adding or replacing a sub-processor that processes customer personal data, or where we materially change the region in which an existing sub-processor operates. Customers may object via dpo@lawfuze.com; objections without a viable workaround are treated as a termination trigger under our DPA.

Transfer risk assessments

Where data leaves the UK or EEA we operate under the ICO International Data Transfer Agreement (IDTA) supported by a published Transfer Risk Assessment. TRAs are available to customers under NDA via dpo@lawfuze.com.

Related

  • Privacy Policy
  • Customer DPA template
  • Trust Center
LawFuze

AI-powered legal practice management for UK solicitors. Augmenting legal expertise with intelligent technology.

Product

  • Chat AI
  • Document Intelligence
  • Matter Management
  • Time & Billing
  • Compliance & Audit
  • Security
  • Legal Research (Phase 2)
  • Judge Intelligence (Phase 2)
  • War Room (Phase 2)
  • Methodology

Company

  • About
  • For Solicitors
  • Request beta access
  • Contact

Trust & Legal

  • Trust Center
  • Privacy Policy
  • Sub-processors
  • Terms of Service
  • Acceptable Use
  • DPA Template
  • Beta Agreement
  • Complaints
  • Cookies
  • Accessibility
  • DPO
  • Disclaimers
AI Disclaimer

LawFuze provides AI-powered tools designed to assist qualified legal professionals. AI outputs are for informational purposes only and do not constitute legal advice. All AI-generated analysis includes confidence scores and source citations and should be independently verified by a qualified solicitor before reliance. LawFuze does not replace the professional judgement of a regulated legal practitioner.

Regulatory Notice

LawFuze is a technology platform and is not a law firm. We do not provide legal advice or legal services. Solicitors using LawFuze remain individually responsible for compliance with the SRA Standards and Regulations and the SRA Code of Conduct. Use of AI tools does not diminish a solicitor's duty to their clients or professional obligations.

Data Protection

LawFuze processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Customer data is stored in the UK on Microsoft Azure (UK South region). AI inference uses named sub-processors in the EU and US; where data flows outside the UK/EEA we rely on ICO International Data Transfer Agreements (IDTAs) supported by published Transfer Risk Assessments — treat IDTA execution as an in-progress control until each is signed and filed. The current sub-processor list and IDTA status of each is published on our sub-processor register. For data subject rights including access, rectification, erasure, and portability, contact legal@lawfuze.com.

Security & Compliance Roadmap
ICO controller registration· LiveUK GDPR aligned· LiveDPIA + ROPA published· LiveCyber Essentials Plus· In progressComputational Analysis Licence (case law)· In progressPII / Cyber / D&O insurance· In progressISO 27001· On roadmapSOC 2 Type II· On roadmap

Certifications in progress or on the roadmap are not current attestations. We publish certificate references only once an accredited body has issued them.

© 2026 LawFuze Ltd. All rights reserved.

Registered in England & Wales • Company No. 16800372 • Registered Office: 4 Enriqueta Rylands Close, Stretford, Manchester, M32 0NW

ICO data-protection registration confirmed (May 2026) — registration number published on the Trust Center. VAT registration in progress; reference will be added on receipt.

Data Protection Officer: dpo@lawfuze.com · Security: security@lawfuze.com · Complaints: /complaints