Subprocessor Notice
Current subprocessors
| Subprocessor | Purpose | Customer Personal Data | Region | Transfer basis |
|---|---|---|---|---|
| Microsoft Azure | Hosting, compute, Table and Blob storage, monitoring, Key Vault, container registry and apps | Platform and Customer Data according to feature | Primarily UK South; registry and ancillary services may use other regions | UK / EU Microsoft DPA; adequacy or SCCs / UK Addendum as applicable |
| Microsoft (Bot / Agents / Graph) | Microsoft Teams communications; Microsoft 365 directory read and write operations | Messages, identities, tenant, directory, device, licence, sign-in and action data | Customer Microsoft region; EU / UK / global service routing | Microsoft DPA and applicable transfer mechanism |
| Microsoft Azure OpenAI | Default AI inference and embeddings for platform processing | Inputs, support and knowledge-base content, and Output | UK South (data processed and stored in the UK) | Microsoft DPA; data remains in the UK region |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | Optional — only where an Enterprise tenant supplies its own OpenAI key (not used for default platform processing) | Inputs, support and knowledge-base content, and generated Output | US and configured / available regions | Adequacy where applicable and/or SCCs / UK Addendum / IDTA |
| Anthropic (Anthropic PBC) | Optional AI inference and selected assistance features | Inputs, support and knowledge-base content, and Output | US and other documented regions | SCCs / UK Addendum / IDTA as applicable |
| Microsoft Azure Communication Services | Phone numbers, PSTN calls and SMS | Phone numbers, messages, audio and transcripts, call metadata | UK (UK numbers; UK data-location) | Microsoft DPA; UK / EU data handling |
| Microsoft Azure AI (Voice Live) | Real-time speech-to-text and text-to-speech for the voice assistant | Caller audio, transcript and generated audio | EU (Sweden Central) | Microsoft DPA; data processed in the EU |
| Stripe (Stripe Payments Europe Ltd / Stripe Inc.) | Subscription, invoicing and payment processing | MSP billing, contact and payment metadata; no complete card details reach KYRA | EU / US | Stripe DPA and applicable transfer mechanism |
| Slack (Slack Technologies LLC / Salesforce) | Slack channel integration where enabled | Messages, user and workspace identifiers, and interaction metadata | US / global | Slack / Salesforce DPA and applicable transfer mechanism |
| Brevo SAS | Transactional and customer email | Recipient address, name, and message or notification content | EU and documented infrastructure | Brevo DPA and applicable transfer mechanism |
| Cloudflare Inc. | DNS, CDN and security for the marketing website | Website request metadata (marketing website) | Global edge | Cloudflare DPA and applicable transfer mechanism |
Customer-selected systems
PSAs and documentation platforms connected under the Customer’s own contract — such as ConnectWise, HaloPSA, Jira Service Management, NinjaOne, IT Glue, Hudu and CIPP — are ordinarily recipients or processors selected by the Customer rather than KYRA-appointed Subprocessors. KYRA transmits data to them on Customer instruction; they are your processors, not KYRA’s Subprocessors. Where KYRA, rather than the Customer, contracts for such a service, it is treated as a KYRA-appointed Subprocessor and listed above.
AI provider gating
Which AI provider processes support content is controlled per tenant. By default this is Microsoft Azure OpenAI in the UK (UK South); Enterprise customers may pin a different provider or region, or bring their own key. See AI Transparency.
Changes & objections
KYRA will give at least 30 days’ prior notice of a new or replacement Subprocessor that processes Customer Personal Data, except an urgent security or continuity replacement, which will be notified as soon as reasonably practicable. Customers may object on reasonable, documented data-protection grounds under the DPA; where we cannot resolve an objection in good faith, you may terminate the affected service in line with your agreement.
Subscribe to notices through the MSP portal or your registered Account email. Contact [email protected] for evidence or objections.
Contact
Kyra.bot Ltd — company number 17408470 (registered in England & Wales)
66 Paul Street, London, EC2A 4NA, United Kingdom
Data-protection contact: [email protected]