TSE-Assistant
Sub-processors
Last updated: 21 September 2026
These are the companies that process personal data for us in running TSE-Assistant. For company accounts they are the sub-processors the Data Processing Agreement authorises; we give account owners at least 30 days' notice by e-mail before adding or replacing one. Everything is stored and processed in the United Kingdom unless the table says otherwise.
Processors and sub-processors
| Who | What | Where | Safeguard for data outside the UK |
|---|---|---|---|
| Microsoft Azure (Container Apps, Azure Database for PostgreSQL, Azure Files, Log Analytics) | Hosting, the database, index storage, service logs | UK South | Not needed for storage; Microsoft's own remote support access is covered by the Microsoft Products and Services Data Protection Addendum |
| Microsoft Azure OpenAI | TSE's LLM — gpt-4.1-mini: the prompts of seats on TSE's LLM and of Sofia in the dashboard, Teams and Slack, and the answers | UK South (processing and storage; abuse-monitoring review by authorised Microsoft staff) | Microsoft Data Protection Addendum |
| OpenAI, L.L.C. | TSE's LLM — gpt-5.6-terra, only when a company's admin allows the model: the prompts and the answers, kept by OpenAI up to 30 days for abuse monitoring | United States | EU Standard Contractual Clauses with the UK Addendum, in OpenAI's Data Processing Addendum (incorporated by its Services Agreement); our transfer risk assessment |
| Microsoft Azure AI Bot Service | Sofia in Microsoft Teams — the messages between Teams and Sofia | Global service; may process outside the UK | Microsoft Data Protection Addendum |
| Microsoft Azure Communication Services (Email) | The mails we send — invitations, credit alerts, the receipts for data protection requests: recipients, subjects, content in transit | UK data location; Microsoft says such data may transit or be processed in other geographies | Microsoft Data Protection Addendum |
| Cloudflare, Inc. | Our domain's DNS, and the routing of e-mail sent to our addresses to our inbox | Global | Cloudflare's Data Processing Addendum |
| Google LLC (Gmail) | Receives the e-mail sent to our addresses (support@, privacy@, security@, innovation@, admin@) | Global | Google's consumer terms — an interim arrangement; we are moving these addresses to a business mailbox with a data processing agreement and will update this page when done |
Independent controllers (not sub-processors)
| Who | What | Where |
|---|---|---|
| Paddle (Paddle.com Market Ltd; Paddle.com Inc. for buyers in the US; Paddle.com (Canada) Ltd in Canada) | Merchant of record: checkout, payment, invoices, tax, refunds — under Paddle's own privacy notice | United Kingdom (US and Canada for buyers there) |
| Microsoft (Entra ID) and GitHub | Your sign-in — they send us your identity under your own relationship with them | Global |
| Slack Technologies, LLC | Sofia in Slack — your workspace carries the messages between you and Sofia under your own agreement with Slack; we hold the bot token your admin granted (encrypted) and call Slack's API with it to answer you | Global |
| The AI providers you configure yourself (your own API key; GitHub Copilot, Cursor or Claude in your IDE) | What your tools send them, under your own agreement with them | Their terms |
Questions: privacy@tse-assistant.com.