For your IT team
The information your IT team needs.
Check how each product handles your information, then ask for the detailed pack.
OpsWork
- What it reads
- Your connected email, files and project records.
- What it writes
- Prepared replies, invoice drafts and project records for your team to approve.
- What it never does
- Nothing goes out without your approval. Your data is not used to train models.
- Where data lives
- Your own Microsoft 365 and Azure, with processing in UK South.
Letterbox
- What it reads
- The email, profile and calendar information you authorise.
- What it writes
- Reply drafts and the email moves you approve.
- What it never does
- It cannot send mail, and it never deletes your mail.
- Where data lives
- Your email stays in your Microsoft 365 mailbox. Optional processing is listed under service providers.
HVCO
- What it reads
- Site information, route options and the values you supply.
- What it writes
- Study drafts and project records for your engineer to check.
- What it never does
- It does not fill missing values silently or replace your engineer’s review.
- Where data lives
- Your projects are stored and processed on your own computer. Optional connections share information only when you enable and authorise them.
Service providers
Who processes information and where
Who does what
OpsWork deploys into each customer's Microsoft environment. This inventory includes customer-contracted processors as well as OpsWork sub-processors, the payment processor for subscriptions bought on this website, and the statistics and advertising tools the cookie banner can switch on, which load only if you accept their cookies.
| Provider | Role | Environment | Processing documents |
|---|---|---|---|
| Microsoft Azure | Hosting, storage, secret storage and operational telemetry in the customer Azure subscription. | UK South deployment | Microsoft Products and Services Data Protection Addendum |
| Microsoft Azure Document Intelligence (optional document reading) | Used only if a customer switches on document reading (OCR) and its managing director acknowledges this boundary. A customer-owned resource under the customer's Microsoft agreement. Selected document copies and the extracted text and layout are processed in Microsoft-managed UK South shared regional temporary storage, logically isolated by customer subscription and credentials, not storage wholly inside the customer's subscription. Microsoft states input and results are deleted 24 hours after analysis completes; OpsWork does not promise immediate deletion. | UK South; Microsoft-managed processing and temporary storage | Microsoft Document Intelligence processing disclosure |
| Microsoft 365 | Customer-owned email and SharePoint. Source originals are unchanged by knowledge import. Optional document reading sends selected document copies to Microsoft Document Intelligence, listed above. System notification email uses Microsoft Graph / the Office 365 connector. OpsWork's own Microsoft 365 sends this website's emails and demo invitations. | Customer tenant and Microsoft service residency | Microsoft Products and Services Data Protection Addendum |
| Azure OpenAI | AI processing hosted by Microsoft. Model storage and service-level retention are different: selected features and abuse-monitoring arrangements can involve service storage. Review the configured deployment and Microsoft processing terms. | UK South deployment requirement | Microsoft Products and Services Data Protection Addendum |
| Microsoft Azure AI Speech (Letterbox spoken commands, optional) | Used only if spoken commands are switched on in Letterbox. Short recordings of what the person says, one sentence at a time, are sent to Microsoft's speech service to be turned into text. Letterbox keeps the text and the time, not the sound. Microsoft states that for real-time speech to text the audio is processed in memory and not stored. | UK South | Microsoft Products and Services Data Protection Addendum |
| Cloudflare | Public website delivery and DNS, the human check on website forms (Turnstile), the website functions that pass an enquiry on, the anonymous visit count (Web Analytics), and forwarding email sent to our opswork.uk addresses, all separate from the customer Microsoft environment. Static hosting is not an EU-only processing guarantee. | Global edge network | Cloudflare Customer Data Processing Addendum |
| Stripe Payments Europe, Ltd | Payment processor for subscriptions bought on this website. Card details are entered on Stripe's own page and go to Stripe: OpsWork does not see or store them. OpsWork keeps the billing record (firm, billing email, plan, amounts, invoices and payment status). | Stripe and its affiliates; see the Stripe Data Processing Agreement | Stripe Data Processing Agreement |
| Google Analytics (GA4) (Google Ireland Ltd / Google LLC) | Google processes the visit statistics for us as our processor. Consent: it loads only if you accept Statistics cookies on the cookie banner, and you can withdraw that at any time. What it collects: Pages viewed, time on page, device and browser type, approximate location from a shortened IP address, a random visitor ID. | EU and United States (UK adequacy regulations / Data Privacy Framework UK Extension) | Google Ads Data Processing Terms |
| Microsoft Clarity (Microsoft Ireland Operations Ltd / Microsoft Corporation) | Microsoft handles the data as an independent controller, under Clarity's own terms. Consent: it loads only if you accept Statistics cookies on the cookie banner, and you can withdraw that at any time. What it collects: How pages are used: clicks, scrolling and page views, replayed as anonymous recordings with typed text hidden, and a random visitor ID. | United States (Data Privacy Framework UK Extension) | Microsoft Clarity terms of use |
| Google Ads conversion tag (Google Ireland Ltd / Google LLC) | Google receives the advert measurement data as an independent controller. Consent: it loads only if you accept Advertising cookies on the cookie banner, and you can withdraw that at any time. What it collects: That a visitor who clicked one of our Google adverts went on to an important page, with a random ID. | EU and United States (UK adequacy regulations / Data Privacy Framework UK Extension) | Google Controller-Controller Data Protection Terms |
| LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company / LinkedIn Corporation) | LinkedIn processes the Insight Tag data for us under its Data Processing Agreement. Consent: it loads only if you accept Advertising cookies on the cookie banner, and you can withdraw that at any time. What it collects: Pages viewed, the advert clicked, browser details, and (for LinkedIn members) a link to the LinkedIn account that LinkedIn holds; we see only totals by company, job title and industry. | EU and United States (Data Privacy Framework UK Extension) | LinkedIn Data Processing Agreement |
For AI processing and retention detail, see Microsoft's data privacy documentation. If a link to a Microsoft, Cloudflare or Stripe document has moved, our publisher references give a second route to it.
Notification of changes
OpsWork notifies customers in writing at least 30 days before adding, removing or replacing any sub-processor on this list. Customers may object during that window and terminate without penalty if a material objection cannot be resolved.
For procurement
Read the Data Processing Agreement and data residency information together with the configuration agreed for your organisation.
Questions about this list: [email protected].
Source documents
Publisher documents and directories
- Microsoft Products and Services Data Protection Addendum / Microsoft
If that page has moved, visit the publisher’s directory and search for “Microsoft Products and Services Data Protection Addendum”.
- Cloudflare Customer Data Processing Addendum / Cloudflare
If that page has moved, visit the publisher’s directory and search for “Cloudflare Customer DPA”.
- Stripe Data Processing Agreement / Stripe
If that page has moved, visit the publisher’s directory and search for “Stripe Data Processing Agreement”.
- Data, privacy and security for models sold by Azure / Microsoft
If that page has moved, visit the publisher’s directory and search for “Data privacy Azure OpenAI”.
- G99 connection procedures / National Grid Electricity Distribution
If that page has moved, visit the publisher’s directory and search for “G99 connection procedures”.
- L153: Managing health and safety in construction / HSE
If that page has moved, visit the publisher’s directory and search for “L153 CDM 2015 Guidance on Regulations”.
Ask for the IT pack
The detailed features, reports, permissions and procurement documents are kept together in the pack.
Use your work email. We review the request before sending a pack; the most detailed security information is shared after a short NDA or in a call.
Send the form and we will reply by email. If it does not go through, write to [email protected].
Thank you. We have your request.
We review each procurement request before any document is sent. We will reply by email.