Sub-processors
A sub-processor is a third party we engage to process customer data on our behalf. This list is the authoritative one referenced by our Data Processing Agreement. Every sub-processor that touches customer content does so inside the Region the customer selected; see Data Handling for the per-Region facts.
Last updated: 2026-10-08.
Sub-processors that process customer content
| Sub-processor | Purpose | Where it processes | Safeguard |
|---|---|---|---|
| Microsoft Ireland Operations Ltd (Microsoft Azure) | Compute, storage, queue, secrets and backups; OCR (Azure AI Document Intelligence); AI models for classification, extraction, rules and the assistant (Azure OpenAI; Azure AI Foundry model catalogue, including Anthropic Claude where available in the Region); voice transcription (Azure AI Speech, Australia) | Storage and OCR: the Region (United States Region: United States. Australia Region: Australia. European Union Region, planned: European Union). AI model inference: by default any Azure region where the model is hosted (Global deployment), or the location stated on an Enterprise Order Form. Microsoft support staff may access services from Microsoft's global support locations under Microsoft's data-protection terms | Microsoft Products and Services Data Protection Addendum; EU-US Data Privacy Framework certification; Standard Contractual Clauses |
Customer content sent to the AI models is processed by Microsoft under our Azure agreement. It is not sent to OpenAI or Anthropic directly, and Microsoft does not use it to train models.
Sub-processors that process account data only
These providers never receive documents or extracted data.
| Sub-processor | Purpose | What it receives | Location | Safeguard |
|---|---|---|---|---|
| Resend, Inc. | Transactional email: invitations, password resets, notifications, security alerts, changelog updates | Recipient email address and the message text | United States (sending domain in North Virginia; email metadata and logs stored in the United States) | EU-US Data Privacy Framework and UK Extension; Standard Contractual Clauses as fallback |
| Tally BV | In-app feedback and bug-report form | Only what a user types or attaches in the form, which loads only when a user opens it | Belgium (European Union) | Processing in the EU |
Our own staff
AI Fabric Limited personnel operate and support every Region from where they are based: employees in the European Union, individual contractors in the United States and Australia. They are not sub-processors; their access is governed directly by the Data Processing Agreement, which also lets a customer restrict access to EU-located personnel on its Order Form.
Self-hosted deployments
In self-hosted deployments the software runs in the customer's own cloud subscription. Microsoft (or the customer's chosen providers) is then the customer's own processor, not ours, and this list does not apply. Where we handle customer documents during professional services, the professional-services Data Processing Agreement lists the sub-processors for that work.
Changes to this list
We give at least 30 days' notice before adding or replacing a sub-processor that processes customer content, by updating this page and emailing account administrators. Customers may object on reasonable data-protection grounds as the Data Processing Agreement provides.
To be notified of changes by email, subscribe at docaifabric.com/changelog or write to security@docaifabric.com.