Your data
Your Microsoft environment.
Your data.
Your source email, drawings and project records remain in the Microsoft environment you control. Optional OCR uses the separately disclosed Microsoft-managed UK South processing boundary, with customer-MD acknowledgement before any submission.
Ownership is practical: your tenant, your access decisions and your records when the service ends.
Deployment and data location
One customer environment. A separate public website.
| Surface | Location or boundary | What needs checking |
|---|---|---|
| Optional document OCR (in development; not enabled by this disclosure) | Customer-owned Document Intelligence resource; Microsoft-managed temporary storage; UK South | Selected document copies and extracted text/layout results enter Microsoft's shared regional temporary storage, logically isolated by customer subscription and credentials. This is not storage wholly inside the customer's subscription. Microsoft states input/results are deleted 24 hours after analysis completes; no immediate provider deletion is promised. Explicit customer-MD boundary acknowledgement and service/cost approval are required before submission. Legal review and release remain pending. |
| Customer email and documents | Customer-controlled Microsoft 365 tenant | Verify the tenant's actual Microsoft 365 data location and the approved data flows. Source originals remain customer-controlled. Optional OCR sends selected copies to the Microsoft-managed processing boundary disclosed above. |
| Agent compute and Azure resources | Customer Azure subscription, UK South | UK South is the locked deployment region. Confirm the provisioned services and required capacity. |
| Operational storage and telemetry | Customer Azure subscription; UK South requirement | Key Vault, Application Insights and Log Analytics form part of the deployment design. Review secret permissions, telemetry content and retention. |
| Knowledge graph and project history | Customer Microsoft environment | Fabric / OneLake is part of the knowledge architecture. Confirm the selected deployment, capacity, data flows and regional availability; a diagram is not evidence of a working connection. |
| Backups | Customer Azure Blob configuration | Review UK South storage, redundancy, customer retention requirements and restore-test evidence. No completed restore test is claimed here. |
| System and customer email | Microsoft 365 / Microsoft Graph | Customer-content email belongs to the customer's mailbox boundary. Verify notification routing and the relevant Microsoft service arrangements. |
| AI inference | Customer Azure configuration, UK South deployment requirement | Confirm model availability, deployment type, permissions and the applicable processing commitments. |
| Public website | Cloudflare Pages global edge | Static website delivery is separate from customer agent deployment. Demo requests use the booking service. |
| Support and international transfers | Contractual and service-specific arrangements | Read the DPA, Privacy Policy and sub-processor details. A selected Azure region is not evidence of every possible support or service transfer. |
For your IT and procurement team
The detail is here when you need it.
Customer content, Microsoft service arrangements and public website enquiries have different processing contexts. The procurement pack brings the architecture and processing documents together.
Azure deployment uses UK South. Microsoft 365 residency follows your tenant's service configuration. Microsoft support and processing terms also matter; choosing a region is not, by itself, a promise that every service activity stays in that region.
Published commitments
Residency commitments
Read these commitments alongside the processing arrangements in the DPA and Privacy Policy.
- Customer-controlled boundary
- OpsWork deploys into the customer's own Microsoft 365 tenant and Azure subscription. Customer holds deployment keys, resource locks and billing. Optional OCR has the separately disclosed Microsoft-managed processing boundary below.
- UK South for all production processing
- Per ADR-002, every Azure resource that processes customer data is provisioned in UK South. The wizard refuses to deploy outside UK South for customer environments. We do not use a non-UK region as a hot standby.
- Disclosed processing boundary, no OpsWork-owned OCR tenant
- Customer-owned deployment does not mean every processing copy stays in customer-owned storage. Optional OCR uses Microsoft-managed UK South temporary storage, logically isolated per customer, after explicit customer-MD acknowledgement. It does not use an OpsWork-owned shared tenant or central content lake.
- No training on customer data
- Customer prompts and completions are not used to train, fine-tune or evaluate any model — ours, Microsoft's or OpenAI's. This is contractually guaranteed in the Data Processing Agreement.
- UK processing location is not a blanket transfer guarantee
- OCR processing and temporary storage are configured for UK South. This does not by itself establish the location of every Microsoft support or onward-access operation. Applicable Microsoft terms, access safeguards and any transfer mechanisms require contractual review before use.
- 30-day change notice
- If a sub-processor or region is added, removed or replaced, every customer receives 30 days' written notice before the change takes effect, with a right to object and terminate without penalty if the objection cannot be resolved.