Legal
Sub-processors
A sub-processor is a third party we use to deliver the hosted CASEY service. UK GDPR and EU GDPR require us to publish them, so customers know who may have access to their data, where they operate and what they do for us.
Hosting, Storage, Backup
The cloud and infrastructure providers that operate the platform.
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| OVHcloud OVH Groupe SAS, France |
Compute, block storage, object storage, network for the hosted SaaS | Tenant databases, evidence media, application logs, backups | London (UK1) by default; EU regions on request |
| Cloudflare Cloudflare, Inc., US — UK/EU PoPs |
WAF, DDoS protection, edge TLS termination | HTTP request metadata only — no case data persisted | UK / EU edge points of presence |
| Backblaze Backblaze, Inc., US — EU region |
Off-region encrypted backup target | Client-side encrypted backup blobs (we hold the key) | EU region (Amsterdam) |
| Let's Encrypt Internet Security Research Group, US |
Public TLS certificate issuance | Domain names only — no customer data | n/a (CA service) |
Sign-In and MFA
The identity providers that authenticate users into hosted CASEY tenants.
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Microsoft Entra External ID Microsoft Ireland Operations Ltd |
Identity provider for hosted tenants — sign-in, MFA, password reset | Email address, display name, sign-in events, MFA factors | EU (Microsoft EU Data Boundary) |
| Customer-owned IdP e.g. customer's own Entra, Okta, Google Workspace |
Federated SSO into customer's CASEY tenant — at customer's option | Whatever the customer's IdP issues in tokens (typically email, OID, role claims) | Customer's choice |
Logging, Monitoring, Status
Tools used to operate the platform — not for case data, but for the metadata that keeps the platform running.
| Sub-processor | Purpose | Data category | Location |
|---|---|---|---|
| Better Stack Better Stack s.r.o., Czechia |
Centralised application + system log aggregation, uptime monitoring | Application logs, error traces, uptime probe results — case data never logged in cleartext | EU |
| Instatus Instatus, US |
Public status page (status.forensiccasemanagement.com) | Service health metadata only — no customer data | EU edge / US origin |
| GitHub GitHub, Inc., US |
Source-code hosting and CI/CD for the CASEY codebase | Source code, build artefacts — no customer production data | US (GitHub Enterprise / EU Data Residency on roadmap) |
AI Providers (Opt-In)
AI-assisted analysis is disabled by default. A customer must explicitly enable it on their tenant, and selects the provider. No data is sent to an AI provider unless the customer has opted in.
| Sub-processor | Purpose | Data category | Customer control |
|---|---|---|---|
| OpenAI / Anthropic / Azure OpenAI | Optional AI features — nominal extraction, draft narrative, summarisation | Whatever the customer submits to an AI feature in the UI | Disabled by default. Per-tenant opt-in. Customer chooses provider, model and region. |
When This List Changes
ForenSecure will publish updates to this page at least 30 days before adding or replacing a sub-processor that processes customer data. Customers on enterprise contracts receive an email notification at the same time. A right of objection is set out in our DPA.
List effective date: 1 May 2026.
Last reviewed: 1 May 2026.