Sub-Processor List

Lists third parties used by Refract Logic, for enterprise procurement requirements.

Last updated: 2026-05-31. Version: 1.0.

This document lists third parties used by Refract Logic, provided for enterprise procurement requirements.

Understanding the Two Processing Scopes

Refract Logic LLC has two distinct processing scopes with different sub-processor profiles:

Customer-deployed infrastructure - the Azure resources deployed into the customer's own Azure subscription via Bicep. Sub-processors here are sub-processors of your organisation, not of Refract Logic LLC. You engage them directly under your Microsoft Customer Agreement.
Refract Logic-operated services - the Licensing API, eSign Portal, and REFRACT Notification service (which uses shared Azure Communication Services for outbound email when Bring-Your-Own email is not configured), operated by Refract Logic. These are the Refract Logic-operated services relevant to a DPA with Refract Logic LLC.

Scope Overview

flowchart TB
    subgraph YourOrg["🏢 Your Organisation (Data Controller)"]
        Users["👤 Users & Approvers"]
        subgraph YourAzure["Your Azure Subscription (Microsoft MCA - you are the controller)"]
            Functions["The Dispatcher · The REFRACT Engine<br/>Azure Service Bus queues · Azure Key Vault<br/>Azure Blob Storage · App Insights"]
        end
        subgraph YourM365["Your Microsoft 365 Tenant (Microsoft MCA - you are the controller)"]
            SPODoc["SharePoint Libraries<br/>Activity Lists · Entra ID"]
        end
    end

    subgraph REFRACT PDFOp["🔐 Refract Logic LLC (Limited Processor)"]
        LicAPI2["Licensing API<br/>(Microsoft Azure · East US)<br/>Receives: license key + tenant ID only"]
        eSignPortal2["eSign Portal<br/>(Microsoft Azure · East US)<br/>Receives: signer/recipient contact details, OTP hashes, session state"]
        Notify2["REFRACT Notification service<br/>(Microsoft Azure · East US)<br/>Receives: notification metadata only"]
        SharedACS2["Shared ACS Email<br/>(Microsoft Azure · East US)<br/>Receives: recipient email + notification text<br/>only when BYO email is NOT configured"]
        Notify2 --> SharedACS2
    end

    Users --> YourM365
    Users --> YourAzure
    Functions -->|"license key + tenant ID - no document content, no PII"| LicAPI2
    Functions -->|"HMAC token - no document bytes, no identity data"| eSignPortal2
    Functions -->|"notification metadata (BYO not configured)"| Notify2

    style REFRACT PDFOp fill:#fce4ec,stroke:#c62828
    style YourOrg fill:#e8f5e9,stroke:#2e7d32

Refract Logic-Operated Sub-Processors

These sub-processors process data on behalf of Refract Logic LLC in the operation of the Licensing API, eSign Portal, and REFRACT Notification service.

Sub-processor	Purpose	Data processed	Location	Safeguard
Microsoft Azure (Microsoft Corporation)	Hosts REFRACT PDF Licensing API and eSign Portal	License keys, tenant IDs, signer/recipient contact details and session state; signature images, field values, and REFRACT Workflow attachment uploads transit in memory, not written to storage	East US	Microsoft Data Processing Agreement; EU SCCs (Art. 46(2)(c))
Azure Communication Services (Microsoft Corporation)	Outbound email for REFRACT PDF shared email infrastructure (`noreply@refractplatform.com`, `noreply@refractplatform.com`)	Recipient email address, email body	East US	Microsoft DPA; EU SCCs

Bring Your Own Email

When you configure Bring Your Own Email (-EmailProvider customer-acs), your Azure Communication Services resource is used instead of Refract Logic shared email. In that case, Azure Communication Services is your sub-processor, not Refract Logic LLC's.

Customer-Deployed Infrastructure Sub-Processors

These are sub-processors engaged directly by your organisation when you deploy REFRACT PDF into your Azure subscription. Refract Logic LLC is not a party to these agreements.

Sub-processor	Service	Data processed	Notes
Microsoft Corporation	Azure Functions, Azure Service Bus queues, Azure Blob Storage, Azure Key Vault, App Insights, Log Analytics	Document payloads, PDFs, audit logs, encryption keys	Under your Microsoft Customer Agreement and Data Processing Addendum
Microsoft Corporation	SharePoint Online, Entra ID	Documents, approver identities, Activity list data	Under your Microsoft 365 subscription and MCA DPA
Microsoft Corporation	Azure Communication Services (optional)	Approver/recipient email addresses, email content	Only when BYO email is configured

Data Flows to Sub-Processors

Data	Recipient	Data content
License key and Microsoft 365 tenant ID	REFRACT PDF Licensing API (Microsoft Azure)	Non-personal identifiers
Signer/recipient session data	REFRACT PDF eSign Portal (Microsoft Azure)	Contact details, OTP hashes, and session state, held in the portal's own database. Every document download redirects to your own Dispatcher or SharePoint site; the portal never receives document bytes. Signature images and field values a signer submits, and REFRACT Workflow attachment uploads, pass through the portal in memory on their way to your Dispatcher and are never written to its storage.
Notification emails	Refract Logic shared Azure Communication Services (Microsoft Azure) or your Azure Communication Services	Recipient email and notification text (no document content unless you include it in email templates)
All document data, PDFs, audit records	Your Azure subscription (Microsoft Azure)	Under your own MCA

Engagement Notices

Refract Logic LLC commits to:

Notifying customers of any intended changes to this sub-processor list with 30 days' notice before the change takes effect.
Providing customers with the opportunity to object to the change. If no resolution is possible, either party may terminate the relevant services on notice.

DPA and Sub-Processor Inquiries

Contact our privacy team for Data Processing Agreement requests and sub-processor questionnaires.

Privacy Inquiries Back to Trust Center