01
How to read this register
Core providers support the customer platform or a feature represented in the reviewed service configuration. Legiscope uses commercial AI services from OpenAI, Anthropic and Google Gemini and may select any one of them for a bounded task; only the provider selected for that operation receives its input. Operational providers support billing, correspondence, scheduling or the public website and do not receive Customer Content unless a person deliberately supplies it through that channel.
A service provider may perform different legal roles for different data. This register describes the operational boundary; the customer DPA and the provider-specific terms determine the contractual role for the processing in scope.
The cards name provider organisations and services. The exact contracting legal entity can depend on the provider account, service and customer location; the controlled entity-level record is confirmed from the applicable Legiscope provider agreement and is available during procurement.
02
Customer platform providers
These providers support the hosted Legiscope application and AI-assisted workflows.
AWS · EU application cloud infrastructure AWS · public website and booking infrastructure
Core providerAmazon Web Services
- Contracting entity
- Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855 Luxembourg, Grand Duchy of Luxembourg — the AWS contracting entity for the EU-hosted services.
- Purpose
- EU application hosting, identity, storage, security, recovery and supporting infrastructure. Public website delivery, contact routing and demonstration-booking infrastructure.
- Data in scope
- Customer Content, account and authentication data, service records, uploaded files, job data, and proportionate security and diagnostic metadata. Website connection and security data and public contact or demonstration-booking fields routed through the infrastructure.
- Processing context
- The primary customer application is hosted in the European Union (Ireland), with a protected customer-object recovery copy in France. The applicable AWS DPA includes transfer safeguards for restricted transfers. The public demo-booking service runs in the European Union (Ireland).
- Transfer basis
- Standard processing is EEA-only (Ireland, with recovery in France) and involves no restricted transfer. A residual restricted transfer — such as non-EEA support access — is covered by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, processor-to-processor module) incorporated in the AWS Data Processing Addendum and by Amazon Web Services, Inc.’s certification under the EU–US Data Privacy Framework.
Commercial API · AI-assisted processing
AI providerOpenAI
- Contracting entity
- OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland — the API contracting entity for EEA-based customers under the OpenAI data processing addendum.
- Purpose
- One selectable commercial API route for user-invoked AI-assisted operations.
- Data in scope
- When selected: minimum source material or Customer Content, task instructions, workflow context and generated output required for the invoked operation.
- Processing context
- Legiscope uses OpenAI through commercial API routes. Model selection may vary by task and configuration. For Customer Content, Legiscope enables only a contracted route under which inputs and outputs are not used to train, fine-tune or improve a general-purpose or cross-customer model. Processing and retention follow the contracted API service, DPA and enabled controls; processing may involve the United States.
- Transfer basis
- Legiscope contracts with OpenAI Ireland Ltd. Processing may involve OpenAI’s United States entities as a restricted transfer, covered by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, processor-to-processor module) incorporated in the OpenAI Data Processing Addendum and, where held by the importing entity, its certification under the EU–US Data Privacy Framework.
Commercial API · AI-assisted processing
AI providerAnthropic
- Contracting entity
- Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland — the commercial API contracting entity for EEA-based customers under the Anthropic data processing addendum.
- Purpose
- One selectable commercial API route for user-invoked AI-assisted operations.
- Data in scope
- When selected: minimum source material or Customer Content, task instructions, workflow context and generated output required for the invoked operation.
- Processing context
- Legiscope uses Anthropic as a commercial AI provider and may route a bounded operation to an Anthropic model. For Customer Content, Legiscope enables only a contracted route under which inputs and outputs are not used to train, fine-tune or improve a general-purpose or cross-customer model; the applicable DPA governs commercial processing and transfers.
- Transfer basis
- Legiscope contracts with Anthropic Ireland, Limited. Processing may involve Anthropic’s United States entities as a restricted transfer, covered by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, processor-to-processor module) incorporated in the Anthropic Data Processing Addendum and, where held by the importing entity, its certification under the EU–US Data Privacy Framework.
Gemini API paid services · AI-assisted processing
AI providerGoogle Gemini
- Contracting entity
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — the provider of the Gemini API paid services to customers based in the EEA.
- Purpose
- One selectable paid commercial API route for user-invoked AI-assisted operations.
- Data in scope
- When selected: minimum source material or Customer Content, task instructions, workflow context and generated output required for the invoked operation.
- Processing context
- Legiscope uses Google Gemini as a commercial AI provider and may route a bounded operation to a Gemini model. For Customer Content, Legiscope enables only a paid contracted route under which inputs and outputs are not used to train, fine-tune or improve a general-purpose or cross-customer model. Global processing and limited abuse-monitoring logs are governed by the applicable terms and DPA.
- Transfer basis
- Legiscope contracts with Google Ireland Limited. The paid Gemini API involves global processing as a restricted transfer, covered by the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914, processor-to-processor module) incorporated in the applicable Google data-processing terms and by Google LLC’s certification under the EU–US Data Privacy Framework.
03
Operations, scheduling and billing
These providers support Legiscope business operations or the public website. They are listed for transparency but do not receive platform Customer Content through those functions.
Gmail · business correspondence Gmail and Google Calendar · correspondence and appointments
Operational providerGoogle Workspace
- Contracting entity
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — the Google Workspace contracting entity for EEA-based customers.
- Purpose
- Legiscope business correspondence and customer-relationship administration. Contact correspondence, demonstration appointments and privacy-rights correspondence.
- Data in scope
- Professional names, work contact details, correspondence and attachments supplied through the business-contact channel. Names, business email addresses, correspondence, appointment time, optional organisation or message, invitee details and meeting records.
- Processing context
- Google Workspace supports professional correspondence and Calendar appointments. It is not an application content store. Google publishes its Workspace subprocessors and applicable data-processing terms; processing locations depend on the Workspace service and configuration.
- Transfer basis
- Workspace processing may involve restricted transfers, covered by the EU Standard Contractual Clauses incorporated in the Google Workspace data-processing terms and Google LLC’s certification under the EU–US Data Privacy Framework.
reCAPTCHA · public form abuse prevention
Operational providerGoogle reCAPTCHA
- Contracting entity
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with onward transfers to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA under the applicable safeguards.
- Purpose
- Abuse prevention for public contact and demonstration-booking forms.
- Data in scope
- reCAPTCHA token and the device, browser, network and interaction information Google requires for risk analysis; no platform Customer Content.
- Processing context
- reCAPTCHA loads only when a visitor proceeds with the contact or demonstration-booking form. From 2 April 2026, Google acts as processor for reCAPTCHA Customer Data under the Google Cloud Terms and Cloud Data Processing Addendum; Legiscope remains controller for this use.
- Transfer basis
- reCAPTCHA risk-analysis data may be transferred to Google LLC in the United States, covered by the EU Standard Contractual Clauses incorporated in the applicable Google terms and Google LLC’s certification under the EU–US Data Privacy Framework.
Stripe Billing and Payments
Operational providerStripe
- Contracting entity
- Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland — the Stripe contracting entity for EEA-based businesses.
- Purpose
- Subscriptions, invoices, payment status and related billing administration.
- Data in scope
- Billing contacts, postal address, tax identifiers, subscriptions, invoices, payment tokens and transaction metadata; no platform Customer Content.
- Processing context
- Stripe’s legal role can vary by payment activity and jurisdiction. Processing and international transfers follow the applicable Stripe services agreement, DPA and service-provider list.
- Transfer basis
- Stripe processing may involve restricted transfers, covered by the EU Standard Contractual Clauses incorporated in the Stripe Data Processing Agreement and, for the United States, Stripe, Inc.’s certification under the EU–US Data Privacy Framework.
04
AI selection and safeguards
- Legiscope uses OpenAI, Anthropic and Google Gemini through centrally controlled model routes and may use any of them for any AI-assisted operation, according to capability, performance, cost, security and risk profile.
- The browser does not send Customer Content directly to an AI provider. A bounded backend job sends only the content and context selected for the authorised workflow.
- Model names and versions can change under controlled routing. The provider identity and contractual terms, not the model label, determine the applicable processing position.
- The linked commercial provider terms describe whether inputs and outputs are used for model training or product improvement. The applicable service tier, enabled controls and provider abuse-monitoring or security retention must be checked for the selected route.
- AI output remains draft decision-support material and requires authoritative human review.
05
Locations, transfers and assurance
An EU application region does not mean every optional or operational service is processed only in the EU. Legiscope assesses the actual provider, service, destination, access pattern and contractual transfer safeguard for the customer scope.
Provider certifications and independent reports describe that provider’s controls; they are not Legiscope certifications. Evidence may be shared during procurement subject to the provider’s distribution terms.
06
Changes and questions
Legiscope reviews this public register when a provider, purpose or material processing boundary changes. For contracted customer processing, the applicable DPA governs advance notice, the notification channel and any right to object to a new or replacement subprocessor.
A customer or procurement reviewer may ask contact@legiscope.com which providers apply to a proposed workflow and request the current contractual record. Customer-directed exports and integrations are not Legiscope-appointed subprocessors merely because a customer chooses to connect them.