Legal
Sub-processors and data transfers
VeriVeri — customer-managed Azure application
Version 1.0Last updated: 25 August 2026
This page lists the third parties that may process personal data in connection with VeriVeri, and where that processing takes place. It is referenced by our Data Processing Agreement and by the amendment to the Microsoft Standard Contract that applies when you acquire VeriVeri through the Azure Marketplace.
1. What this list covers — and what it does not
VeriVeri runs inside your own Azure subscription. In normal operation Northloop Group AB does not receive or process the content you submit for verification, so for that content we are neither controller nor processor. The parties below are therefore relevant in two narrower situations:
- When we act as your processor — support you request, including any access to the managed resource group in your subscription (section 2).
- When we act as controller — website enquiries, Azure Marketplace order data, and the support mailbox (section 3). Listed for transparency; these are our service providers rather than sub-processors in the Art. 28 sense.
Not on this list: the AI model providers your deployment calls. You choose and configure them — Azure AI Foundry in your own subscription by default, optionally external providers — and they are your own sub-processors, under your control (see the Privacy Policy, section 4.3).
2. Sub-processors when we act as your processor (support)
| Sub-processor | Purpose | Location of processing |
|---|---|---|
| Microsoft Ireland Operations Ltd. (Microsoft Azure) | The cloud platform in which your managed application runs and through which any support access is exercised. Access is limited to the managed resource group, under the authorisation you granted at deployment, and is logged in your Azure Activity Log. | The Azure region you chose for your deployment (EU or US) |
| Microsoft Ireland Operations Ltd. (Microsoft 365) | The support mailbox (support@veriveri.io) and case handling: the text and any attachments you choose to include in a case, whether sent from the dashboard or by email. | EU (Microsoft 365 with EU data residency) |
No other party has access to personal data during support. We do not use sub-contractors for support.
3. Service providers for our own processing (controller)
| Provider | Purpose | Location of processing |
|---|---|---|
| Microsoft Azure — Static Web Apps, Functions, Communication Services | Hosting of veriveri.io and delivery of contact-form messages to us | EU |
| Microsoft 365 | Email, calendar and documents for our business correspondence | EU |
| Microsoft Partner Center (Azure Marketplace) | Order and lead details Microsoft shares with us when you acquire VeriVeri through the Marketplace — typically name, business email, company, country and the plan acquired. For the Marketplace transaction itself Microsoft acts as an independent controller under the Microsoft Privacy Statement. | Microsoft’s Partner Center regions |
4. Email sent by your deployment
At deployment, the wizard creates an Azure Communication Services resource in your own subscription and region. Your deployment uses it to send the welcome email to the operator address you entered. If you opted in to onboarding assistance in the wizard, it also sends one notice to support@veriveri.io containing the operator email address(es) you entered — and nothing else. No other data leaves your deployment to us.
5. International transfers
We perform support from Sweden. In the ordinary course of support we do not transfer personal data outside the EU/EEA: support access to a deployment is exercised through Azure within the region of that deployment, and case correspondence stays in EU-resident Microsoft 365. Where any transfer to a third country were to occur, it would rely on an adequacy decision (Art. 45) or Standard Contractual Clauses with supplementary measures (Art. 46). If you deploy VeriVeri in a US region, that choice, and any resulting processing by Microsoft in the US, is yours as controller.
6. Changes to this list
We announce any intended addition or replacement of a sub-processor on this page at least 14 days before it takes effect. If you object on reasonable data-protection grounds, write to support@veriveri.io within that period and we will discuss alternatives, including ending the affected processing. To be notified of changes by email, ask us at the same address.
| Date | Change |
|---|---|
| 25 August 2026 | First publication (version 1.0). |
7. Contact
Northloop Group AB · Org. nr 559579-7787 · Birger Jarlsgatan 99B, 113 56 Stockholm, Sweden · support@veriveri.io.