LEgal
Sub-processor Details
Client Engagements
FRA uses a number of sub-processors when providing services to its clients. The sub-processors used for each engagement will vary depending on the services requested, the requirements of each client and the agreed terms of the client engagement.
The table below lists details of the sub-processors used by FRA and the circumstances in which they are used (subject to specific engagement terms as agreed with a client).
| Name | Description of processing | International transfers | Is this processor applicable? |
|---|---|---|---|
| FRA Affiliates | |||
|
Forensic Risk Alliance Inc (US) Forensic Risk Alliance Limited (UK) Forensic Risk Alliance S.A.R.L (FR) Forensic Risk Alliance SA (CH) |
Support in provision of client services as required. | Any transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA/Swiss personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. |
✓ If FRA personnel from FRA affiliates perform services on a client engagement. X If the provision of services is subject to geographic restrictions.* |
| FRA Infrastructure, Security & Maintenance | |||
| Microsoft Ireland Operations Limited |
Microsoft 365 business tools, including Outlook, SharePoint, OneDrive, Teams etc. Azure cloud hosting of Client Data if required. |
Any transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA/Swiss personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. |
✓ Our communications with you utilise Microsoft 365 business tools. X Where Client Data sets are stored on-premise. ✓ Where Client Data sets are stored on Microsoft Azure.* |
| Atmosera, Inc | Provision and management of Microsoft Azure resources including security and threat monitoring and incident response as required. | Transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA/Swiss personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. |
X if Client Data is stored on-premise. ✓ if Client Data is stored on Microsoft Azure. |
| eSentire, Inc |
Provision of FRA Security Operations Centre. Activity involves monitoring of FRA’s endpoint security protection on all servers and devices and incident response as required. eSentire will receive metadata should there be a potential issue identified (e.g. file paths/file names, running processes, currently logged-in users). Personal data transfers are limited. |
Transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA/Swiss personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. | ✓ Always applicable. |
| Darktrace Holdings Limited |
Monitoring of network communications for anomalous behaviour. Darktrace may receive metadata (e.g. file names, server names, user names, etc.) as part of the traffic it monitors. Personal data transfers are limited. |
Any transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. | ✓ Always applicable. |
| Atlassian Pty Ltd |
IT support ticketing tool. Project management and eDiscovery collaboration and support tool. |
Atlassian is certified to the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. Also in place with Atlassian are Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA/Swiss personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. |
✓ If you raise an IT support request with FRA. ✓ If the services require project management and collaboration. |
| Client Services: eDiscovery | |||
| RELATIVITY ODA LLC | Cloud-based eDiscovery Platform for the provision of eDiscovery services. | Any transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA/Swiss personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. |
✓ Only if Relativity cloud-based eDiscovery tools are provided as a service. X If eDiscovery is not required for the services or FRA on-premise instance of Relativity is to be used. |
| GeorgeJon, Inc |
Infrastructure maintenance and monitoring of FRA Relativity environments including 24/7 operations and monitoring and incident response as required. Majority of data transferred is metadata about system performance or processing issues. Personal data transfers are limited. |
Any transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA/Swiss personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. | ✓ If Relativity eDiscovery services are being provided. |
| eDiscoveryAI LLC | AI-powered solutions for legal discovery, review and privacy. | Any transfers of Client Personal Data to the US and other restricted countries/entities will be carried out pursuant to the Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 of 4 June 2021 for EEA personal data and under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, in force 21 March 2022, for UK personal data. | ✓ Only if eDiscovery AI tools are specified for the services. |
| * As specified in the engagement terms relating to a client matter. | |||
Version: November 2025