LEGAL

Sub-processors

Last updated 15 May 2026

Lawyerly works with a small set of vetted partners to deliver its legal service. This page lists every organisation that may process personal data on our behalf, what they do, where data is stored, and the transfer safeguards in place.

Lawyerly Group: Group operational support

The South African parent of Lawyerly Ltd. Provides operational support to the legal service, including matter administration, onboarding, and platform operations. Processing is governed by an Intra-Group Services Agreement that applies UK GDPR equivalent standards.

South Africa
UK IDTA, supported by a Transfer Risk Assessment

Shft: Technology partner

Builds and maintains the Client Hub and the systems behind the legal service. Access to client data is restricted to what is necessary for technical operations, granted on a least-privilege basis, time-bound, and logged.

South Africa
UK IDTA, supported by a Transfer Risk Assessment

Seek the Just: Marketing

Processes contact data of prospective clients and individuals who engage with our marketing channels, on our documented instructions and for marketing purposes only.

South Africa
UK IDTA, supported by a Transfer Risk Assessment

Microsoft: Productivity, email, document storage

Hosts our email, document storage, and core productivity environment. Our tenant is provisioned in the United Kingdom Local Region Geography. Microsoft Corporation is a US-incorporated entity with potential parent-level access from the United States.

United Kingdom (steady-state hosting); United States (parent entity)
UK Extension to the EU-US Data Privacy Framework

Stripe: Payment processing

Processes payments at checkout and on renewal. Full card details are handled directly by Stripe under PCI DSS and are not stored by Lawyerly.

United States and Republic of Ireland
UK Extension to the EU-US Data Privacy Framework

HubSpot: CRM and marketing automation

Holds contact records, marketing engagement data, and pipeline information. Our account is hosted in HubSpot's EU data region.

European Union (steady-state hosting); United States (parent entity)
UK Extension to the EU-US Data Privacy Framework

Auth0: Identity and access management

Provides single sign-on, multi-factor authentication, and user lifecycle management for the Client Hub and our internal systems. Auth0 is operated by Auth0, Inc., a US-incorporated Okta company.

United States
UK Extension to the EU-US Data Privacy Framework

Sendbird: In-app messaging in the Client Hub

Powers real-time messaging between clients and their solicitor inside the Client Hub. Our workspace is hosted in the European data region.

European Union (steady-state hosting); United States (parent entity)
Standard Contractual Clauses with UK Addendum

ComplyCube: AML and identity verification

Performs the regulated AML, KYC, and identity checks we are required to carry out on clients. ComplyCube is registered with the Information Commissioner's Office and is DIATF-certified under the UK digital identity framework.

United Kingdom
Intra-UK; no transfer mechanism required

Anthropic: AI tooling for legal work

Provides the Claude AI model used for narrow, supervised legal and operational tasks. Personal data submitted through the API is not used to train Anthropic's models, and we operate under zero-data-retention configuration for API workloads.

United States
Standard Contractual Clauses with the UK Addendum, supported by a Transfer Risk Assessment

BetterStack: Uptime monitoring and incident management

Monitors the availability of the Client Hub infrastructure. Limited personal data may appear incidentally in operational logs. BetterStack is operated by Better Uptime, headquartered in Prague, Czech Republic.

Czech Republic (EU)
UK adequacy regulations

Fireflies: Meeting transcription

Records and transcribes meetings between Lawyerly and clients, with participants notified and consent recorded in line with our meeting practice.

United States
Standard Contractual Clauses with UK Addendum, supported by a Transfer Risk Assessment

monday.com: Internal operations workspace

Used for internal compliance and operational registers. Personal data appears only where matter or supplier records reference identifiable individuals.

Germany (monday.com's EU data centre)
UK adequacy regulations

Cloudfare: Content delivery and website security

Sits in front of the Lawyerly website as our content delivery network and security layer, providing bot protection, traffic filtering, and service availability. It processes limited personal data such as IP addresses and sets the strictly necessary cookies described in our Cookie Policy

United States
UK Extension to the EU-US Data Privacy Framework