A2Z CareHub Sub-Processors
This page lists the sub-processors that support A2Z IT Limited in delivering the A2Z CareHub platform. It is referenced from our Privacy Policy and our Platform Terms of Use.
A "sub-processor" is a third party that processes personal data on our behalf in connection with the Platform. We use a small number of sub-processors, all of which are bound by contractual obligations consistent with our obligations to our customers under the UK GDPR.
Current sub-processors
| Sub-processor | Role | Primary processing location | Transfer safeguards |
|---|---|---|---|
| Microsoft Corporation / Microsoft Ireland Operations Limited | Azure infrastructure: hosting, database, storage, authentication (Entra External ID), communications (Azure Communication Services), monitoring (Application Insights), and reporting (Power BI Embedded, where deployed) | United Kingdom (UK South) | UK Addendum to EU Standard Contractual Clauses / UK International Data Transfer Agreement; UK-US Data Bridge for any onward transfer to United States entities |
| Microsoft Corporation (Azure OpenAI Service) | AI inference for the Platform's AI agents | United Kingdom (UK South) for data at rest; individual AI requests may be processed for inference in other Microsoft Azure regions worldwide (Azure OpenAI global deployment) | As above. See Privacy Policy section 7 for current notes on Azure OpenAI abuse-monitoring retention |
| Cloudflare, Inc. | DNS, edge proxying, TLS termination for the Platform's domains | Global edge network | UK International Data Transfer Agreement; UK-US Data Bridge |
| Google LLC | Identity provider integrated into Microsoft Entra External ID, for customer organisations using Google Workspace | United States | UK International Data Transfer Agreement; UK-US Data Bridge |
| Microsoft Corporation (Microsoft Clarity) | Visitor analytics on the public marketing pages only (home, features, free trial, contact, security, accessibility and vision). Runs without cookies. Never loaded inside the Platform, on sign-in, invitation or survey pages, so it processes no customer or care data | Microsoft data centres, which may be outside the United Kingdom | UK-US Data Bridge; Microsoft Products and Services Data Protection Addendum |
How we manage sub-processors
We assess each sub-processor before engagement, considering data protection, security, contractual safeguards, and operational fit. We review the sub-processor list periodically and when material platform changes are planned.
Notification of changes
We notify customer organisations of material changes to this list — for example, the addition of a new sub-processor or the change of role of an existing sub-processor — in line with the Data Processing Agreement between A2Z IT and the customer organisation. Non-material changes (such as the addition of a sub-processor's affiliated entity to a transfer arrangement) take effect on publication.
Contact
For questions about our sub-processors:
A2Z IT LimitedPrivacy contact: privacy@a2zit.ai
Website: a2zit.ai
Platform: a2zcarehub.co.uk