Legal transparency
Subprocessors
A short list of third parties Opcilo uses to run the Service. Referenced by our Privacy Policy and Data Processing Addendum (Annex III).
Last updated: October 10, 2026
Purpose
These vendors help us host documents, authenticate users, send notifications, and process payments. Opcilo remains responsible for subprocessors under our customer agreements.
Current subprocessors
| Subprocessor | Function | Categories of data | Primary location(s) |
|---|---|---|---|
| Microsoft Azure | Hosting, document storage, and related platform services | Account, seal, tenancy, and customer document data | Active multi-region document planes: UAE North (geo-backup to UAE Central where configured) and Canada Central — workspace residency follows the Available region chosen for that workspace |
| Microsoft Entra External ID | Identity and sign-in | Identity claims and email addresses | Microsoft tenant configuration (often multi-region) |
| Azure Communication Services | Email notifications | Email addresses, names, and notification content | Resource region (may include United States until region-pinned) |
| Twilio | SMS and WhatsApp notifications | Phone numbers and message content | Twilio global infrastructure |
| Stripe | Payments and subscriptions | Billing contact details, tax identifiers, and payment metadata (Opcilo does not store card PAN) | Stripe regional processing (often US/EU) |
Regional processing
Opcilo runs active production in Azure UAE North and Canada Central for document storage and seal metadata. Workspace documents stay in the Available region chosen for that workspace; we do not claim that every related service (identity, billing, or notifications) always stays in that same country. Some subprocessors may process data outside your chosen document plane. Where law requires transfer safeguards, Opcilo relies on appropriate mechanisms such as provider DPAs or Standard Contractual Clauses.
Changes to this list
We update this page when we add or replace material subprocessors. Organization customers also receive notice through commercially reasonable channels (for example, email to workspace administrators). You may object on reasonable data-protection grounds as described in our Data Processing Addendum.
Questions
For questions about this list or to raise a subprocessor objection, contact privacy@opcilo.com.