Data processing and subprocessors
Subprocessors used in the delivery of engagements and in the operation of licensed platforms are listed here with their function and the region in which data is processed. The list is specific to what this practice operates; group-level legal terms are canonical on gda.group (D-I).
Subprocessor categories
| Function | What it covers |
|---|---|
| Cloud infrastructure | Compute, storage and networking for hosted deployments. Region is selected per engagement and stated in the agreement. |
| Managed data services | Databases and queues supporting hosted platform deployments. |
| Observability | Logging, metrics and alerting for services we operate under managed services. |
| Business systems | Email, document management and the enquiry handling behind this site. |
| Model providers | Where an engagement uses them, contracted by the client unless otherwise agreed in writing. We do not resell model capacity. |
The register is compiled per engagement, because a licensed platform deployed into a client’s own cloud has a different subprocessor set from one we host. The engagement-specific register is provided during vendor onboarding and before any data processing agreement is signed.
Data handling in engagements
- We prefer not to hold your data at all.Most engagements can be delivered against synthetic or masked data. Where production data is genuinely required, the requirement is stated and scoped rather than assumed.
- Personal data stays off shared ledgers by design.This is an architectural position, not a configuration one, and it shapes what we will and will not recommend building.
- Residency is selected per engagement.And written into the agreement. A default region chosen by us is not a decision you should discover later.
- Retention is yours to set.We hold engagement records for the period agreed and delete on the schedule stated, including from backups on their own cycle.
Agreements
Our data processing agreement position is provided in advance on how to buy us, alongside the MSA position, insurance and entity details. Group-level privacy terms are canonical on gda.group; this site’s own privacy notice is here.