Skip to main content
LawFuzeICO registered
For SolicitorsTrustPricing
Sign inGet Early Access→

UK GDPR · Article 28

Sub-processor register

Every processor LawFuze relies on to deliver the service, the region your data is processed in, and the lawful transfer mechanism we rely on where data leaves the UK or EEA. We notify customers via this page at least 30 days before onboarding any new sub-processor that handles personal data.

Last updated: 11 October 2026·Next review: Monthly during Phase 1

Current register

Sub-processorRoleRegionTransfer basisStatus
Microsoft AzurePrimary cloud: compute, PostgreSQL (including the search index), Blob Storage, Redis, Key Vault, logs, and Azure AI search indexing (text embeddings)UK South (London); backups replicated to UK WestUK only — no transferLive
Anthropic PBCAI drafting, chat and analysis (Claude models)USArt 46 IDTA pendingLive
ResendTransactional email: sign-in, password reset and security alerts, plus the notifications each user chooses to get by email — task assignments, matter updates and deadline reminders, which can include matter titles and due datesEU (sending) / USArt 46 IDTA pendingLive
Vercel Inc.Hosting for the lawfuze.com website until it moves to Microsoft Azure UK SouthGlobal edge / USArt 46 IDTA pendingLive
Zoho CorporationEmail mailboxes (founders@, dpo@, legal@, billing@, privacy@, security@)India (Zoho .in data centre)Art 46 IDTA pendingLive
CohereRe-ranking of retrieval resultsEU / CanadaArt 46 IDTA pendingPhase 2
Stripe Payments UK LtdCard payments + subscription billingUK / EU / US (segregated)Art 46 IDTA pendingPhase 2
GoCardless LtdDirect debit billing for UK firmsUKUK onlyPhase 2
Twilio Ireland LtdVideo consultations (WebRTC, recording, transcription)EU / USArt 46 IDTA pendingPhase 2
Deepgram, Inc.Speech-to-text for video / audioUSArt 46 IDTA + TRA pendingPhase 2
Sentry (Functional Software)Error monitoring (PII-scrubbed)EUAdequacyPlanned

Sign-in providers

You can choose to sign in with Google or LinkedIn. They are not sub-processors: they don't process your firm's data for us. They act as independent controllers of your account with them, and when you choose one, it tells us your name, email address (and whether it's verified), profile picture and an account identifier — never your password. Nothing from your matters is sent to them. Firm admins and compliance officers always sign in with email, password and a second factor.

What status means

  • Live — actively processes production data; DPA in place where required.
  • Onboarding — service is wired in but IDTA/DPA counter-signature is still in flight. Personal data flow is gated on the document being executed.
  • Phase 2 — listed for transparency but not switched on. We update this page at least 30 days before enabling one.

Notice of changes

We will publish a notice on this page at least 30 calendar days before adding or replacing a sub-processor that processes customer personal data, or where we materially change the region in which an existing sub-processor operates. Customers may object via dpo@lawfuze.com; objections without a viable workaround are treated as a termination trigger under our DPA.

Transfer risk assessments

Where data leaves the UK or EEA we operate under the ICO International Data Transfer Agreement (IDTA) supported by a published Transfer Risk Assessment. TRAs are available to customers under NDA via dpo@lawfuze.com.

Related

  • Privacy Policy
  • Customer DPA template
  • Trust Center
LawFuze

An AI co-worker for UK solicitors — research and drafting support, supervised by the solicitor on the file. Hosted in UK data centres.

Product

  • Chat AI
  • Document Intelligence
  • Matter Management
  • Time & Billing
  • Compliance & Audit
  • Security
  • Legal Research (Phase 2)
  • Judge Intelligence (Phase 2)
  • War Room (Phase 2)
  • Methodology

Company

  • About
  • For Solicitors
  • Get started
  • Contact

Trust & Legal

  • Trust Center
  • Privacy Policy
  • Sub-processors
  • Terms of Service
  • Acceptable Use
  • DPA Template
  • Early-access agreement
  • Complaints
  • Cookies
  • Accessibility
  • DPO
  • Disclaimers
AI Disclaimer

LawFuze provides AI tools that support qualified legal professionals with research and drafting. AI outputs are not legal advice. Every AI output carries a confidence indicator and source citations, and must be reviewed by a qualified solicitor before reliance. The supervising solicitor — not the AI — remains responsible to the client under the SRA Code of Conduct.

Regulatory Notice

LawFuze is a technology platform and is not a law firm. We do not provide legal advice or legal services. Solicitors using LawFuze remain individually responsible for compliance with the SRA Standards and Regulations and the SRA Code of Conduct. Use of AI tools does not diminish a solicitor's duty to their clients or professional obligations.

Data Protection

LawFuze processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Customer data is stored in the UK on UK data centres. AI inference uses named sub-processors in the EU and US; where data flows outside the UK/EEA we rely on ICO International Data Transfer Agreements (IDTAs) supported by published Transfer Risk Assessments — treat IDTA execution as an in-progress control until each is signed and filed. The current sub-processor list and IDTA status of each is published on our sub-processor register. For data subject rights including access, rectification, erasure, and portability, contact legal@lawfuze.com.

Security & Compliance Roadmap
ICO controller registration· LiveUK GDPR aligned· LiveDPIA + ROPA· In progresslegislation.gov.uk + TNA Find Case Law (OGL v3.0, read use)· LiveCyber Essentials Plus· In progressDeeper case-law search index (public UK judgments)· In progressPII / Cyber / D&O insurance· In progressISO 27001· On roadmapSOC 2 Type II· On roadmap

Certifications in progress or on the roadmap are not current attestations. We publish certificate references only once an accredited body has issued them.

© 2026 LawFuze AI Systems Limited. All rights reserved.

Registered in England & Wales • Company No. 16800372

Support: support@lawfuze.com

ICO controller registration ZC147676 (14 May 2026 — 13 May 2027) — listed on the Trust Center. VAT registration in progress; reference will be added on receipt.

Data Protection Officer: dpo@lawfuze.com · Security: security@lawfuze.com · Complaints: /complaints