Skip to content

Trust centre

Who processes your data

We run Assembly on a deliberately small set of providers, and we share only what each service needs. This register is the complete list: if a provider isn't here, it doesn't touch your data.

Subprocessor register

Microsoft Azure

UK (Azure UK South)

Runs the entire service in the UK: hosting, database, file storage, background jobs, edge security, AI, email and monitoring. The AI is Azure OpenAI, operated by Microsoft in the UK South region; requests are not routed outside the UK, OpenAI the company never receives your data, and nothing is used to train AI models. Sign-in links and notifications are sent through Azure Communication Services, configured for UK data residency.

Data handled: All service data, at rest and in transit

PostHog

EU

Product analytics: which features are used, so we can improve the product. Events are tied to a session so we can make sense of them, but PostHog never sees your child's profile, answers or reports. We don't sell your data, and we minimise what PostHog receives.

Data handled: Usage events tied to a session (not your child's data)

The rules every provider is under

  • Each provider processes data only on our instructions, under a data-processing agreement.
  • No provider may use your family's data to train AI models.
  • Your child's profile, answers and reports are processed in the UK, in Microsoft Azure. The only thing processed outside the UK is usage analytics (PostHog, EU): it's linked to a session, not your name, and it never receives your child's profile, answers or reports.
  • There is no identity provider on this list because there isn't one: sign-in runs inside our own application and database.
  • This register is generated from our code, not hand-maintained. If we add a provider, an automated check makes us update this page.

Want notice when this register changes, or detail on a specific provider? Email ayse@getassembly.co.uk .