What Opscera holds. Supplier and material records, purchase order lots, certificates of analysis, the audit log, and the email addresses of supplier contacts. Supplier contact details are business contact data. That is the only personal data the system routinely processes.
Separation between clients. Each client’s records sit in their own database instance. There is no shared table of everybody’s suppliers. Configuration is held separately from client data, and the configuration layer never holds supplier records. Certificate documents are stored under a key structure prefixed by client, so one client’s documents can be located and deleted independently.
Sub-processors. The system runs on a defined set of sub-processors, with data processing agreements in place with each. The full register is provided during onboarding and forms part of the data processing agreement. Nothing is added to it without notice.
| Sub-processor | What it holds | Storage location | Transfer mechanism |
|---|---|---|---|
| Formagrid Inc, trading as Airtable | Compliance records: purchase order lots, suppliers, certificate records, audit log | United States | UK International Data Transfer Addendum to the EU standard contractual clauses, per section 9.3 of the executed DPA. EU SCCs Module 2 applies, governed by the law of Ireland. |
| Hetzner Online GmbH | Application hosting | European Economic Area only, per section 3(1) of the executed DPA. Company registered in Gunzenhausen, Germany. | None required. The UK recognises the EEA as providing an adequate level of protection. |
| Zoho Corporation Limited | European Union data centre | Section 7.2 of the executed DPA confines processing and transfer to the UK and EEA. | |
| Cloudflare, Inc. | Stored certificate documents | Western Europe location hint. This is a best-effort placement, not a jurisdictional guarantee. | EU standard contractual clauses as amended by the UK International Data Transfer Addendum, per section 6.2(b) of the Cloudflare Customer DPA. Cloudflare additionally certifies under the Data Privacy Framework, per section 6.4. |
Cloudflare’s DPA states at section 6.1 that Cloudflare and its sub-processors may process personal data outside the European Economic Area.
Each provider maintains its own current sub-processor list. Airtable’s is at airtable.com/company/subprocessors.
Document parsing. Text extraction from certificates is deterministic by default. Higher-confidence parsing using a language model is available as a per-client option. It is off unless you turn it on, and turning it on is a decision you make with the sub-processor named in front of you. It is not a platform default, because that would make it an undisclosed processor in your supply chain.
Email. The supplier receives a chase email that references their purchase order and lot. Certificate replies arrive at a dedicated address for your business. That address is not shared and is not accessible to other clients.
Retention and exit. A retention schedule is agreed at onboarding. You can export your complete records, including the full audit log, at any time without asking. If the relationship ends, the data is yours and the evidence stays with your business.
Governing documents. Solis Group Ltd is ICO registered. A data processing agreement, technical and organisational measures document, record of processing activities, sub-processor register, retention schedule and breach procedure are all in place and provided at onboarding.
Book a process review