When we provide the Reglo Services, we engage a small number of sub-processors to process personal data on behalf of our customers. We carry out due diligence on each one and have written contracts in place that meet the requirements of Article 28 UK GDPR. This page forms part of our Data Processing Agreement.
Infrastructure & hosting
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Cloud infrastructure, database hosting, and AI inference (Amazon Bedrock) | United Kingdom (London, eu-west-2) |
| Vercel Inc. | Website hosting and content delivery | United States / global edge |
Your account content, uploaded documents, and any files processed for reviews are hosted in the United Kingdom (AWS London, eu-west-2).
AI models
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | Large language models for in-product AI features, accessed in-region via Amazon Bedrock | United Kingdom (via AWS Bedrock, eu-west-2) |
| OpenAI | AI inference and embeddings for in-product features, accessed in-region via Amazon Bedrock where available | United Kingdom (via AWS Bedrock, eu-west-2) |
We run AI inference through Amazon Bedrock within our UK region (eu-west-2). Model providers are accessed in-region via Bedrock, do not receive your content outside that service, and do not use your content to train their models.
Billing, email & operations
| Sub-processor | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd | Payment processing and subscription billing | EU (Ireland); United States |
| Twilio Inc. / SendGrid | Transactional and notification email delivery | United States |
| Functional Software, Inc. (Sentry) | Error monitoring | European Economic Area |
| Axiom Inc. | Application logging | European Economic Area |
| Google LLC / Microsoft Corporation | Single sign-on, where you choose to use it | United States / global |
Systems you connect
Practice management systems you connect for file reviews — currently LEAP, Clio and Actionstep — are your firm's own systems that you authorise us to access. They are your data sources, not our sub-processors. What we access from them, and how that data is handled, is covered in our Data Processing Agreement and our Privacy Policy.
Changes and how to be notified
Before we add or replace a sub-processor that processes customer personal data, we will give at least 30 days' notice. To be notified of changes, or to raise a reasonable objection on data-protection grounds, email privacy@useReglo.com.