Service providers
A clear view of
who does what.
OpsWork deploys into each customer's Microsoft environment. That is not a promise that all processing or storage remains inside the customer tenant: optional OCR uses the Microsoft-managed UK South boundary described below. This inventory includes customer-contracted processors as well as OpsWork sub-processors. Listing a service does not authorise its use or replace contractual notice, solicitor review, customer-MD acknowledgement or release approval.
| Provider | Role | Environment | Processing documents |
|---|---|---|---|
| Microsoft Azure Document Intelligence (optional OCR; in development) | Customer-owned resource; normally Microsoft's direct processing service under the customer's Microsoft agreement, with contractual classification for solicitor review. Selected document copies and extracted text/layout results are processed in Microsoft-managed UK South shared regional temporary storage, logically isolated by customer subscription and credentials—not storage wholly inside the customer's subscription. Microsoft states input/results are deleted 24 hours after analysis completes. No immediate deletion promise. Requires explicit customer-MD boundary acknowledgement and service/cost approval before any document submission; legal review and release remain pending. | UK South; Microsoft-managed processing and temporary storage | Microsoft Document Intelligence processing disclosure ↗ |
| Microsoft Azure | Compute, storage, Key Vault and operational telemetry in the customer Azure subscription. | UK South deployment | Microsoft Products and Services Data Protection Addendum ↗ |
| Microsoft 365 | Customer-owned email and SharePoint. Source originals are unchanged by knowledge import. Optional OCR sends selected document copies to the separately disclosed Microsoft Document Intelligence service. System notification email uses Microsoft Graph / the Office 365 connector. | Customer tenant and Microsoft service residency | Microsoft Products and Services Data Protection Addendum ↗ |
| Azure OpenAI | AI processing hosted by Microsoft. Model storage and service-level retention are different: selected features and abuse-monitoring arrangements can involve service storage. Review the configured deployment and Microsoft processing terms. | UK South deployment requirement | Microsoft Products and Services Data Protection Addendum ↗ |
| Cloudflare | Public website delivery and DNS, separate from the customer Microsoft environment. Static hosting is not an EU-only processing guarantee. | Global edge network | Cloudflare Customer Data Processing Addendum ↗ |
For AI processing and retention detail, see Microsoft's data privacy documentation.
Notification of changes
OpsWork notifies customers in writing at least 30 days before adding, removing or replacing any sub-processor on this list. Customers may object during that window and terminate without penalty if a material objection cannot be resolved.
For procurement
Read the Data Processing Agreement and data residency information together with the configuration agreed for your organisation.
Request the procurement pack →
Questions about this list: [email protected].