Sub-processors.

The sub-processors and third parties Fig Technology Limited engages in connection with the Fig Platform.

Fig Group Trust Centre · www.figgroup.co.uk/subprocessors

Version 1.0.0 · Effective 17 June 2026 · Reviewed at least annually

This page lists the sub-processors and third parties Fig Technology Limited ("Fig") engages in connection with the Fig Platform (FigQms). It is incorporated by reference into the Fig MSP Subscription Agreement (UK and US), and each sub-processor that processes personal data on a customer's behalf is engaged under data-protection terms no less protective than Fig's Data Processing Agreement (DPA). Fig remains responsible for its sub-processors.

Section 1

Customer-data sub-processors (Fig as processor)

These parties may process personal data that a customer inputs into the platform. Fig acts as processor and, in the MSP model, sub-processor for this data.

Sub-processor	Service	Processing region	Transfer mechanism
Microsoft Azure Microsoft Ireland Operations Limited / Microsoft Corporation	Cloud hosting and platform services, including compute, storage, database services, networking, security monitoring, observability, and related cloud infrastructure processing. Sole hosting and core-infrastructure provider; Azure-native platform services are provided under this engagement, not as separate sub-processors.	UK South / West Europe (EU/EEA) for UK/EU tenants; the elected US region (Central US, North Central US or West US 3) for US-residency tenants. Data is held at rest in the elected region; administration is from the UK/EEA unless otherwise agreed.	UK IDTA / EU SCCs, or EU-US Data Privacy Framework where applicable
Microsoft Ireland Operations Limited Microsoft Azure AI services, including Azure OpenAI Service and Microsoft Foundry Models sold by Azure	AI model inference, embeddings, content safety, abuse monitoring, and related Azure platform processing. For Azure-hosted deployments, prompts and completions are not available to OpenAI and the models do not interact with OpenAI-operated services.	Microsoft Azure region or data zone configured for the service.	UK IDTA / EU SCCs, or EU-US Data Privacy Framework where applicable
Anthropic, PBC (Claude) optional AI	Optional AI features only, where the customer enables them using its own subscription. Personal data is scrubbed before any model call; customer data is not used to train the provider's models.	Provider-operated (US)	EU SCCs / DPF as applicable; customer's own provider relationship
OpenAI, LLC (ChatGPT) optional AI	Optional AI features only, on the same opt-in, customer-subscription basis as above.	Provider-operated (US)	EU SCCs / DPF as applicable; customer's own provider relationship
xAI Corp (Grok) optional AI	Optional AI features only, on the same opt-in, customer-subscription basis as above.	Provider-operated (US)	EU SCCs / DPF as applicable; customer's own provider relationship

Section 2

Fig's business-operations vendors (Fig as controller)

These parties support Fig's own business operations. For the limited account, billing and customer-relationship data involved, Fig acts as an independent controller under its Privacy Policy, not as a processor of customer-inputted data.

Vendor	Purpose	Role
Microsoft 365	Internal productivity, email and document collaboration	Processor to Fig
Xero	Accounting and bookkeeping	Processor to Fig
Stripe	Card payment processing for Fig's own invoices	Independent controller for payment processing
DocuSign	Electronic signature of agreements	Processor to Fig
HubSpot	Customer relationship management and marketing	Processor to Fig

Fig's self-hosted AI model. Some AI features can be served by an open-weight model that Fig hosts on its own Azure infrastructure, within Fig's existing security boundary. When this option is used, content is processed inside Fig's environment rather than sent to a third-party AI provider, so no external AI provider acts as a sub-processor for that feature. Personal data is scrubbed before inference, and the model is not trained on customer data.

Changes and objection rights

How we notify customers of sub-processor changes

Fig notifies customers of any addition, replacement or removal of a sub-processor that processes inputted personal data by updating this page and, where subscribed, emailing nominated administrators. Customers may object on reasonable data-protection grounds within 30 days of notification, as set out in the DPA. MSPs are responsible for onward notification to their End Customers.

Questions or DPA requests

Contact for data-processing matters

For a copy of the executed Data Processing Agreement, evidence of Sub-processor due-diligence, or any other data-processing query, please contact our privacy contact at enquiries@figgroup.co.uk.

Publication details

Register owner and contact

Fig Technology Limited · 11 Wandle Bank, Wimbledon, London, SW19 1DW, United Kingdom · Privacy contact: Jay Hopkins, Managing Director.