Sub-processors
Last updated: 29 May 2026
This page lists every supplier (a "sub-processor" in UK GDPR Article 28 terms) that LESSO uses to deliver the service. We split the list in two: data sub-processors, which process customer or personal data, and platform utilities, which support the operation of the service but are not in the path of teacher prompts or generated content.
Subscribe at the bottom of this page if you would like to be emailed before this list changes.
Data sub-processors
These suppliers process customer or personal data on LESSO's behalf. All are pinned to UK regions for the processing of LESSO customer and personal data.
| Supplier | Function | Location | Certifications | Privacy contact |
|---|---|---|---|---|
| Civo Ltd (including relax.ai) | UK-sovereign cloud infrastructure (LON1 region) hosting the LESSO application and customer data, plus primary AI inference via relax.ai. Models in use: Llama 4 Maverick 17B×128E (primary generation), DeepSeek-V4-Pro and Kimi 2.6 (agentic tool-calling), Mistral-7B-Embedding (semantic search and curriculum retrieval), and Voxtral (voice transcription). relax.ai is a trademark of Civo Ltd — the same legal entity, the same DPO, the same DPA, the same UK jurisdiction. We list it once because it is one supplier. Any model hosted outside the Civo LON1 boundary triggers the 30-day change-notification process on this page. | United Kingdom (Civo LON1) | ISO 27001, Cyber Essentials Plus, G-Cloud listed | team@civo.com |
| Microsoft Azure OpenAI Service | Fallback AI inference, configuration-pinned to UK South region. Used only when the primary path is unavailable. | United Kingdom (Azure UK South) — see CLOUD Act note below | ISO 27001/27017/27018, SOC 1/2/3, EU Cloud CoC | aoaisupport@microsoft.com |
Honest note on the US CLOUD Act
Microsoft is a US-headquartered processor. Even though Azure OpenAI is configured to the UK South region for LESSO, US authorities can in theory compel Microsoft to produce data via the CLOUD Act. We use Microsoft only as a fallback path; the primary AI inference for LESSO runs on Civo Ltd (LON1) — a UK-owned, UK-headquartered company whose data is subject only to UK law. We disclose this residual risk rather than hide it, and a school can request that the Azure fallback be disabled for their tenancy as part of the school agreement.
Platform utilities
These suppliers support the operation of the LESSO service (billing, transactional email) but are not in the path of teacher prompts or generated educational content.
| Supplier | Function | Location | Certifications | Privacy contact |
|---|---|---|---|---|
| Stripe Payments Europe Ltd | Subscription billing and payment processing. | Ireland (EU); card data tokenised, never touches LESSO infrastructure. | PCI-DSS Level 1, ISO 27001, SOC 1/2 | privacy@stripe.com |
| Resend | Transactional email delivery (account, billing, product notifications, this trust-hub change-notification list). | United States (mail in transit); sending domain authenticated with DKIM, SPF, DMARC. | SOC 2 Type II | privacy@resend.com |
How we add or change a sub-processor
Our Data Processing Agreement gives schools a contractual right to be told before a sub-processor changes. In practice that means:
- We update this page with the proposed change and the date it takes effect (minimum 30 days in advance for material changes).
- Anyone subscribed below is emailed automatically when this page is updated.
- School-controller customers can object in writing within the notice window; if we cannot accommodate the objection we honour the contract's exit and data-export terms.
Subscribe to change notifications
Be told before a LESSO sub-processor changes. Confirmation by double opt-in. Unsubscribe at any time from the link in every email.
We use Resend to deliver the confirmation and any future notifications. Your email address is stored only for this purpose and is removed when you unsubscribe.
This page is part of the LESSO Trust Hub. See also our DPA, DPIA, security overview, and Privacy Policy.
LESSO Ltd | Registered in England and Wales