Subprocessors and Data Residency Statement

Updated 7 November 2026. AssuraFlow is a product of EchoVell Ltd. See docs/legal/DPA.md §7.1–8.1 for the maintained sub-processor table (locations and DPA status) — this page is intentionally a short summary of it rather than a second copy of the same table.

Purpose

This statement describes the primary infrastructure and service categories used to operate AssuraFlow and where customer data is held.

Where Customer Data Is Held

Customer data is stored and processed in the United Kingdom, on Microsoft Azure (UK South). The application, database, file storage and backups all sit in UK regions.

AssuraFlow has no live customers as of this writing. Before go-live, the service runs in a temporary test environment used for the founder's own testing and the public demo. It holds no real customer or service-user personal data and is not a sub-processor for customer data.

Subprocessor Categories

See docs/legal/DPA.md §7.1 for the full, current table. In short:

• Cloud hosting: Microsoft Azure, United Kingdom (UK South) — application, database, file storage and backups.

• Payment processing: Stripe.

• Transactional email: vendor configurable; the production vendor will be confirmed and listed before go-live.

• Error monitoring: Sentry — not currently receiving production events; region to be confirmed before it is enabled.

• Optional features, off unless an organisation switches them on, each based in the United States: AI text features (Anthropic), voice transcription (OpenAI) and SMS notifications (Twilio).

• Customer data is not moved out of the UK regions without an operational need and appropriate customer approval.

• Backups and replicated copies of customer data stay in the UK.

Before Onboarding a Real Customer

Before onboarding any real customer, the deployment owner confirms:

• production is running on Microsoft Azure in the UK and customer data has actually moved there;
• backup and restore locations, confirmed within UK regions;
• whether AI features (Anthropic), voice transcription (OpenAI) and SMS (Twilio) are enabled, and if so, that each US-based transfer is covered by an appropriate mechanism (for Anthropic, its DPA with the UK Addendum to the EU SCCs);
• any additional operational vendors introduced into the stack.

Change Management

If a new subprocessor category is introduced, or if the data residency position materially changes, the customer-facing deployment record and contractual documentation are updated before the change is relied upon in production.

Security Expectations

All subprocessors used in production should be appropriate for confidential business information and should be configured using least privilege, secure transport, and auditable administrative controls.