Policy

AI data residency and subprocessor commitments

Corbiere lets an administrator choose which model runs the optional AI features and which region runs it. That single choice decides where personal data in a request is processed, which organisations act as processors, and what makes the transfer lawful. This page sets out, for each choice, exactly what those consequences are.

We describe only arrangements that exist as products a controller can actually buy. In particular: Anthropic does not sell a European or United Kingdom regional endpoint for Claude — its own API processes in the United States — so Claude inside the European Union is offered here through Amazon Bedrock in Ireland, where Amazon is the contracting processor, and the direct Anthropic route is described as a transfer to the United States. Statements on this page were last verified against the providers’ own published documentation on 5 September 2026; provider regional offerings move quickly, so verify against their live trust documentation before relying on this page in a filing.

1.What this policy covers

It covers every AI feature in Corbiere: the search assistant, drafted rationales for redactions and exemptions, the contextual scanning pass and the response-letter particulars. It does not cover the rest of the platform — the database, file storage, hosting, email and billing are described in the privacy notice.

Comtech Solutions Limited acts as processor for case content. The AI provider named against the chosen region is a subprocessor engaged for that processing, and the controller is told which one is in use before any AI feature runs.

2.The choices and what each one means

Only these four configurations can be selected. Nothing outside the list is reachable from the application, so the residency position is always one of the following.

Claude Sonnet 4.5 — EU (Ireland)

Amazon Bedrock (Claude by Anthropic), through the Amazon Bedrock runtime endpoint in eu-west-1.

Processing location: European Union — Ireland (eu-west-1)
Contracting entity: Amazon Web Services EMEA SARL (Luxembourg)

Subprocessors for this choice

Amazon Web Services EMEA SARL — Hosts the model and runs the request inside its own Bedrock service. Ireland (European Union)

Basis for the transfer

Inference runs in the AWS Ireland region under the AWS Data Processing Addendum, so no transfer mechanism is engaged for an EU or UK controller. For a Jersey controller the European Union is a jurisdiction the Commissioner treats as adequate, and the transfer is made on that footing under Article 66 of the Data Protection (Jersey) Law 2018. AWS support and its own subprocessors may be located outside the EU; the AWS Data Processing Addendum incorporates standard contractual clauses for that support access, so a controller relying on adequacy alone should note that support access sits under those clauses.

Retention by the provider

Amazon Bedrock does not store prompts or model outputs after the response is returned, and does not use them to train any model. Anthropic does not receive the request: the model weights run inside AWS. Bedrock model invocation logging is a separate feature and is not switched on for Corbiere, so no prompt or response is written to a log in the customer's or our account.

Onward transfers and human review

Anthropic receives no request content under this route. AWS personnel do not access content in the ordinary course; where support access occurs it is governed by the AWS Data Processing Addendum and its standard contractual clauses.

What to record in your own processor register

Record Amazon Web Services EMEA SARL as the AI subprocessor, Ireland as the processing location, and the AWS Data Processing Addendum as the governing terms. Anthropic is not a party under this route.

Claude Sonnet 4.5 — United States

Anthropic (direct API), through the Anthropic Messages API (api.anthropic.com).

Processing location: United States — Anthropic does not offer a regional endpoint
Contracting entity: Anthropic, PBC (San Francisco, United States)

Subprocessors for this choice

Anthropic, PBC — Runs the model and returns the response. United States
Anthropic's own infrastructure subprocessors — Compute and hosting used by Anthropic to serve the API, as listed in its published subprocessor list. United States

Basis for the transfer

This is a transfer to the United States. Anthropic Ireland, Limited exists as the group's European company, but the seller on Claude API invoices remains Anthropic, PBC in San Francisco, so the controller is contracting with a United States entity and the transfer analysis is a transfer to a third country — not an intra-EU or adequacy case. For a Jersey controller that engages Articles 66 and 67 of the Data Protection (Jersey) Law 2018 and requires appropriate safeguards: Anthropic's data processing addendum incorporates standard contractual clauses, and Anthropic self-certifies under the EU-US Data Privacy Framework and its UK extension. A controller choosing this option should complete and record a transfer risk assessment.

Retention by the provider

Zero data retention is not the default. By default Anthropic automatically deletes API inputs and outputs within 30 days. Zero data retention is a separate negotiated agreement, available only for eligible APIs and products. Even under such an agreement there are carve-outs: under Anthropic's Covered Models policy in force from June 2026, prompts and outputs for certain models are retained for 30 days on every platform including for zero-retention customers, and content flagged by trust and safety processes may be held considerably longer.

Onward transfers and human review

Anthropic personnel do not read request content in the ordinary course, but retained content exists and may be reviewed where trust and safety processes flag it, or where an investigation or legal obligation requires it. It is not accurate to say there is nothing to read: the accurate statement is that retained data is not read by personnel by default.

What to record in your own processor register

Record Anthropic, PBC (United States) as the AI subprocessor, standard contractual clauses in Anthropic's data processing addendum as the safeguard, a transfer risk assessment as completed, and 30-day default deletion — or the terms of any zero-retention agreement you hold directly with Anthropic — as the retention position.

This choice sends personal data outside the Jersey, United Kingdom and European Union adequacy perimeter. It is lawful only where the controller relies on appropriate safeguards and has completed and recorded a transfer risk assessment.

GPT-4.1 — UK South

Azure OpenAI Service, through the Azure OpenAI resource pinned to UK South.

Processing location: United Kingdom — UK South
Contracting entity: The Microsoft entity on the customer's Azure agreement — Microsoft Ireland Operations Limited for customers contracted in Europe

Subprocessors for this choice

Microsoft (Azure OpenAI Service) — Hosts the Azure OpenAI resource and runs the model in Microsoft's own tenancy. UK South (United Kingdom)

Basis for the transfer

Inference runs on a resource pinned to UK South under the Microsoft Products and Services Data Protection Addendum. For an EU controller the UK adequacy decision applies; for a Jersey controller the United Kingdom is adequate under Article 66 of the Data Protection (Jersey) Law 2018; for a UK controller no transfer arises. OpenAI does not receive the data — the model runs in Microsoft's tenancy — though Microsoft support may be provided from outside the region under the standard contractual clauses in the addendum.

Retention by the provider

By default Azure OpenAI stores prompts and generated content for up to 30 days for abuse monitoring, and authorised Microsoft reviewers may examine content flagged by that monitoring. Storage and human review stop only where Microsoft has approved modified abuse monitoring for the resource under its Limited Access programme. Do not assume the exemption: the approval status of the resource behind this option is stated on the AI settings page, and Corbiere shows this option as retaining for 30 days unless the exemption is recorded. Prompts and responses are not used to train OpenAI or Microsoft models in either case.

Onward transfers and human review

No onward transfer of request content to OpenAI. Where modified abuse monitoring has not been approved, Microsoft abuse reviewers may see flagged content; where it has, no Microsoft reviewer sees request content.

What to record in your own processor register

Record Microsoft as the AI subprocessor, UK South as the processing location, the Microsoft Products and Services Data Protection Addendum as the governing terms, and 30-day abuse-monitoring storage unless you hold Microsoft's approval for modified abuse monitoring.

GPT-4.1 — EU (Sweden Central)

Azure OpenAI Service, through the Azure OpenAI resource pinned to Sweden Central.

Processing location: European Union — Sweden Central
Contracting entity: The Microsoft entity on the customer's Azure agreement — Microsoft Ireland Operations Limited for customers contracted in Europe

Subprocessors for this choice

Microsoft (Azure OpenAI Service) — Hosts the Azure OpenAI resource and runs the model in Microsoft's own tenancy. Sweden Central (European Union)

Basis for the transfer

Inference runs on a resource pinned to Sweden Central under the Microsoft Products and Services Data Protection Addendum and Microsoft's EU Data Boundary commitment. No transfer mechanism is engaged for an EU or UK controller; for a Jersey controller the European Union is adequate under Article 66 of the Data Protection (Jersey) Law 2018. OpenAI does not receive the data, though Microsoft support may be provided from outside the region under the standard contractual clauses in the addendum.

Retention by the provider

Onward transfers and human review

What to record in your own processor register

Record Microsoft as the AI subprocessor, Sweden Central as the processing location, the Microsoft Products and Services Data Protection Addendum and the EU Data Boundary as the governing terms, and 30-day abuse-monitoring storage unless you hold Microsoft's approval for modified abuse monitoring.

3.Commitments that apply to every choice

These are commitments we make about our own handling. They do not extend to what a provider retains, which differs by choice and is stated against each one above.

Processed only in the selected region

Every prompt and every response goes to the endpoint shown against the choice above, and to nothing else. Corbiere does not route a request to a second provider or a second region for capacity, failover or load balancing. Where a choice processes outside the Islands, the UK or the EU, that is stated plainly against the choice rather than presented as a regional option.

No additional subprocessors introduced by us

The provider named against the choice is the only party Corbiere sends request content to. No broker, router, evaluation service or analytics service sits in between. That provider's own infrastructure subprocessors are its own, and are listed in its published subprocessor list.

Corbiere retains nothing; the provider's retention is stated per choice

Corbiere does not store prompts, results or intermediate steps. It records that a request was made, by whom, against which case, and with which model and region — never the content. What the provider itself keeps differs by choice and is set out against each one above; it is not zero everywhere, and we do not claim that it is.

Human review by the provider is stated, not denied

Where a provider may have staff review flagged content, that is written against the choice. We only say content cannot be seen where the arrangement genuinely prevents it.

4.Parties that never receive request content

No AI broker, router or gateway sits between Corbiere and the provider named against the chosen region.
OpenAI does not receive content under the Azure options: those models run inside Microsoft’s own tenancy in the region shown.
Anthropic does not receive content under the Amazon Bedrock option: the model runs inside the Bedrock service in Ireland, and Amazon is the processor. Anthropic receives content only where an administrator has deliberately selected the direct Anthropic API, which processes in the United States.
No evaluation, benchmarking, analytics or session-replay service receives prompts or responses.
Comtech Solutions staff do not read prompts or responses. The audit log records that a request was made, by whom and against which case — never its content.

5.What is actually sent to the model

Only the passage or document the reviewer is working on, together with the instruction for that feature. Whole case files are never uploaded to the provider, the password vault is never included, and material already marked out of scope is not sent. A reviewer’s decision is always their own: the model proposes wording and candidates, and a person accepts or rejects each one.

6.Transfers and the controller’s own assessment

Transfers of personal data outside Jersey engage Articles 66 and 67 of the Data Protection (Jersey) Law 2018. Choosing a model and region is the controller's decision, not ours: the controller should satisfy itself that the option it selects is lawful for its own transfers, and record that assessment alongside its other transfer decisions. The direct Anthropic option is a transfer to the United States and requires a transfer risk assessment; the Bedrock Ireland and Azure options keep inference inside jurisdictions Jersey treats as adequate.

The equivalent questions arise under the Data Protection (Bailiwick of Guernsey) Law 2017, Chapter V of the UK GDPR and Chapter V of the EU GDPR. Corbiere gives the controller the facts on this page; the decision that a given region is lawful for its own processing remains the controller’s, and should be recorded with its other transfer decisions.

7.Changing the choice, and switching AI off

Only an administrator can change the model or region, and each change is written to the audit log with the person, the time, the previous value and the new value. AI features can be switched off for the whole organisation, and any single case can have AI switched off with a recorded reason, whatever the organisation setting says. With AI off, nothing from that case reaches any provider.

Questions about this policy: dpo@comtech-solutions.co.uk.