Who processes your data, and under which agreements
Overview of the parties Onesurance generally engages, and how we select and manage sub-processors.
- Written notification at least 30 days in advance of any new or replacement sub-processor.
- 14 days to object in writing.
- Processing exclusively within the European Union.
Carefully selected parties for cloud and AI
Onesurance uses carefully selected sub-processors to deliver its services. These parties may process personal data for cloud infrastructure, access management, AI functionality, data integrations and reporting.
Where LLM models are used, Onesurance takes great care to select parties that provide appropriate contractual, organisational and technical safeguards for processing in accordance with applicable European data protection legislation.
Onesurance has appropriate data protection and information security arrangements in place with these parties and periodically assesses whether their services continue to meet the applicable requirements.
Cloud infrastructure, access management and Microsoft services
| Sub-processor | Service / purpose | Personal data | Location | DPA |
|---|---|---|---|---|
| Microsoft (Azure Cloud Services) | Cloud hosting, storage, databases, platform services, authentication and access management, and Power BI | Data that clients process or store via Onesurance; user accounts, authorisations, login data, prompts, context, responses and reporting data | European Union | Yes |
AI models and orchestration
| Sub-processor | Service / purpose | Personal data | Location | DPA |
|---|---|---|---|---|
| Microsoft Azure (Foundry, OpenAI Service) | Service for frontier AI models | Minimised dataset for the agreed services | European Union | Yes |
| Amazon Web Services (AWS Bedrock) | Service for frontier AI models | Minimised dataset for the agreed services | European Union | Yes |
| Google Cloud (Vertex AI) | Service for frontier AI models | Minimised dataset for the agreed services | European Union | Yes |
| Inceptron | Service for open-weight models | Minimised dataset for the agreed services | Sweden / EU | Yes |
| Lyceum | Service for open-weight models | Minimised dataset for the agreed services | Germany / EU | Yes |
| Orq.ai | AI agent platform and orchestration | Minimised dataset for the agreed services | Netherlands / EU | Yes |
Client- and chain-specific data and integration partners
Some parties only apply when Onesurance provides services to a client that is also a customer or user of that party, or when data is supplied or exchanged via that party on the client's instructions. These parties are not engaged for every client. They are recorded per client in the Sub-processors annex to the data processing agreement.
How we select and monitor every sub-processor
Management process
- 30 days in advance: written notification of any addition or replacement.
- Objection within 14 days; the parties will then work together to find an appropriate solution.
- Data processing agreement prevails: where it contains different arrangements regarding sub-processors, those arrangements apply.
- Periodic assessment of whether the services continue to meet the requirements.
Due diligence
- Security assessment of technical and organisational measures.
- Compliance verification against the GDPR and sector-specific requirements.
- Data processing agreement with the same privacy, security, deletion and EU obligations as Onesurance.
- Documentation on request available to clients.
Microsoft (Azure Cloud Services)
Our primary cloud and platform provider, including Azure, Entra ID and Power BI. Data is not stored, processed or made accessible outside the European Union.
- SOC 2 Type II
- ISO 27001 / 27017 / 27018
- GDPR