Legal & Compliance
Sub-Processor List
Last updated: 27 September 2026
Under UK GDPR Article 28, we are required to disclose the third-party sub-processors that process personal data on our behalf. This page provides full transparency about who processes your data, what data they receive, and where processing occurs.
Key commitments: No sub-processor uses your content to train foundation AI models. Some sub-processors retain limited operational metadata (for example, to provide their service or to fulfil a billing record); where a sub-processor's own policy permits broader use of customer data to improve its service, we describe that below and pursue the available opt-out under UK / EU GDPR. We notify paying customers at least 30 days before adding a new sub-processor.
AI Inference
| Provider | Service | Data Received | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Managed large-language-model inference and supporting AI services | Query text, extracted document text, conversation context | UK, and AWS regions outside the UK (EU Standard Contractual Clauses with the UK Addendum) |
- Does NOT receive: Payment information. The AI model receives the text it needs to answer, not your stored files.
- Training: Your data is never used to train AI models. Contractually guaranteed.
- Where: AI requests are processed by Amazon Web Services and may be processed outside the UK under the UK's approved data transfer safeguards.
- Retention: Queries are processed in real time and not kept after the request, except that for some models AWS's automated abuse checks can keep a request they flag for up to 30 days, inside AWS and without sharing it with the company that built the model.
Cloud Infrastructure and Storage
| Provider | Service | Data Received | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Application hosting and compute; encrypted file storage (Amazon S3, AES-256); text recognition for PDFs and images (Amazon Textract) | Every file stored in Writford: matter uploads, files imported from OneDrive and Google Drive, filed emails and their attachments, documents created in Writford, and working copies of chat attachments (deleted after 1 day). PDFs and images are read by Amazon Textract, which does not keep them or use them to improve its services. Application logs and service metadata | UK |
| Amazon Web Services EMEA SARL (Amazon DocumentDB) | Primary application database, hosted in the UK region under UK GDPR Article 28 terms | User accounts, conversations, token usage, matter management data (matter metadata, client / party information, time entries, key dates, conflict records, collaboration data), filed email details, appointments and tasks from connected Microsoft services, and the text passages and search fingerprints used by firm document AI. Backups kept 35 days | UK |
Legal-Source Search
| Provider | Service | Data Received | Location |
|---|---|---|---|
| Brave Software, Inc. (Brave Search API) | Web search used to surface UK legal sources. A fixed list of UK legal and government sources is searched first and ranked highest; a small number of ordinary web results may also be returned, ranked below them | The search query the assistant writes to find legal sources for your question. The assistant is instructed to put in only the legal question and public facts (a court, a company, a statute, a case) and to leave out your client's identity and the private details of the matter. Brave receives that query and returns links; it does not receive your documents, files or conversation history | EU / US, transfers protected under the UK IDTA or the UK Addendum to the EU SCCs |
| The National Archives | UK case-law API (court judgments) | Search queries only | United Kingdom |
| legislation.gov.uk | UK legislation search API | Search queries only | United Kingdom |
- Web search: The provider does not log or track API queries on a per-user basis. Where the provider’s infrastructure processes data outside the UK, Writford relies on the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
- National Archives & legislation.gov.uk: UK Government services. Open data under Open Justice / Open Government licence.
Payment Processing
| Provider | Service | Data Received | Location |
|---|---|---|---|
| Stripe | Subscription billing, payment processing | Name, email, payment card details, billing address | EU/UK (with UK adequacy decision) |
- Does NOT receive: Chat content, documents, legal data, or any AI-processed information
- Security: PCI DSS Level 1 certified (highest level of payment security)
Communication
| Provider | Service | Data Received | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Transactional email delivery (verification codes, account notifications, password reset, billing alerts) | Recipient email address, system-generated email content only | UK |
Website Analytics
| Provider | Service | Data Received | Location |
|---|---|---|---|
| Google LLC (Google Analytics 4) | Cookieless website analytics, page views, traffic sources, aggregate usage. Configured with client_storage: 'none' and anonymised IP. No cookies set on visitor devices. | Anonymised IP address, page URL, referrer, browser/device type | US (Google LLC, subject to EU–US Data Privacy Framework and UK adequacy decision) |
| Ahrefs Pte. Ltd. (Ahrefs Analytics) | Cookieless website analytics. No cookies set on visitor devices. | Anonymised page URL, referrer, aggregate traffic data | SG/US (Ahrefs Pte. Ltd.) |
| Vercel Inc. (Vercel Web Analytics and Speed Insights) | Hosting of this marketing website, plus cookieless visit counting and page-speed measurement taken from real visits. No cookies set on visitor devices and no identifier stored on the device. | Page URL, referrer, country, browser and device type, page-load timings | US (Vercel Inc.), with edge delivery from the region nearest the visitor |
- No user identifiers: No analytics provider receives account data, email addresses, legal content, or matter data.
- No cookies: All three providers are configured in cookieless mode, no analytics cookies are set on visitor devices. PECR consent is not required.
- Marketing site only: These providers run on the public website. They are not present in the application, where your matters and client data live.
Connectors and Integrations
| Provider | Service | Data Received | Location |
|---|---|---|---|
| Microsoft Corporation | Sign in with Microsoft; OneDrive file browser and folder import; Microsoft 365 email, calendar and To Do, each switched on by the user; Microsoft Office Add-in Marketplace, which distributes the Writford for Outlook add-in | The sign-in and consent requests. Microsoft receives what the user asks Writford to put into their own Microsoft account: emails they send, matter dates added to their calendar and tasks in their Writford task list | EU/US (Microsoft EU Data Boundary; standard contractual clauses where applicable) |
| Google LLC | Sign in with Google; Google Drive file picker | The sign-in and consent requests, and requests for the specific files the user picks | US (EU–US Data Privacy Framework; Google API Services User Data Policy applies) |
| Apple Inc. | Sign in with Apple | The sign-in request only | US |
- What each connection can reach, and what Writford keeps: set out connection by connection in Section 6B of our Privacy Policy. In short: a connection that keeps working after the browser closes holds an encrypted long-lived access key; files you import and emails you file are copied into the matter and kept until you delete them.
- Google Drive: the
drive.filepermission, which reaches only the files you pick through Writford. Use of Google user data adheres to the Google API Services User Data Policy, including Limited Use requirements. - Writford for Outlook: AI actions send the open email's subject, sender and body for processing and nothing of it is kept. Attaching an email to a matter files it, as described in Section 6A of our Privacy Policy.
- Your originals are safe: Writford never deletes an email, appointment, task or file in your Microsoft or Google account.
Sub-Processors We Do NOT Use
- No advertising networks or ad-tracking pixels (no Meta Pixel, LinkedIn Insight Tag)
- No behavioural analytics or session-recording tools (no Hotjar, Clarity, FullStory, Mixpanel)
- No email marketing platforms
- No customer data platforms
- No social media integrations
Changes to This List
We will update this page when we add or change sub-processors. Material changes will be notified to customers via email at least 30 days before the change takes effect. If you object to a new sub-processor on reasonable data protection grounds, you may terminate your subscription within 15 days of notification.
Contact
Questions about our sub-processors or data processing: info@writford.co.uk
See also: Privacy Policy | Terms of Service | Security