Subprocessors
Last Updated
18 September 2026
Scope
ChatIBD is operated as a University of Glasgow academic project. To provide the Service we rely on the third-party processors below. Each processes personal information only on our instructions and only as needed for its stated purpose.
Processor list
| Provider | Purpose | Personal information processed | Location |
|---|---|---|---|
| Microsoft Azure | Generate chat responses and structured outputs; produce embeddings; rerank retrieved passages (Cohere model served through Azure); automated safety and quality evaluation (including Claude models served through Azure) | Chat messages, retrieved source context, model responses, embedding inputs | UK South (uksouth) |
| Clerk | Authentication and user identity | Email address, name, Clerk ID, session and auth metadata | United States. EU, UK and Swiss transfers under the Data Privacy Framework. DPA: clerk.com/legal/dpa |
| Neon | Managed Postgres application database, hosted on AWS eu-west-2 | Account and profile records, chats, messages, votes and feedback, guideline metadata, model and prompt tracking | eu-west-2 (London) |
| Vercel | Application hosting and serverless functions (region lhr1) | Requests, IP-derived approximate location, application logs | Functions region lhr1 (London) |
| Amazon Web Services (AWS) | S3 guideline PDF storage and backups; SES/SNS transactional email and delivery events | Guideline files and backup artefacts; email addresses, campaign status, delivery events | eu-west-2 (London) |
| Sentry (Functional Software, Inc.) | Error and performance monitoring. Session replay is not enabled | Device, browser and request metadata, error traces | United States |
| GitHub | Source control and CI, including scheduled monitoring jobs that query the application database | Repository and CI metadata; chat and account records processed transiently by scheduled jobs | United States |
Safeguards
We rely on the data-protection terms each provider offers, including data processing agreements and, for transfers outside the UK/EEA, standard contractual clauses, the UK addendum, or adequacy decisions as applicable. Contact details for requesting further information are in our Privacy Policy.
Changes to this list
We update this page when our processors change. Material changes are notified through updates to our Privacy Policy with a revised “Last updated” date.
Research processing
Formal academic research datasets are governed separately under the relevant research information, consent and privacy materials, not by this page alone. See our Privacy Policy for the distinction between routine service operation and formal research participation.
Contact Us
If you have any questions about our subprocessors, please contact us at privacy@chatibd.com.