Trust & Security

The policies behind the platform, for the security and compliance teams reviewing us.

Last updated October 21, 2026

Policies

How we protect your data, keep the service running and do business responsibly.

Data protection

Data Classification Policy

This policy defines how Subcontext classifies data and the controls applied at each classification level. Classifying data consistently means everyone handling it knows how...

Version 1 · Updated October 21, 2026 Read the policy

Data Retention & Deletion Policy

This policy defines retention periods for data processed by Subcontext and the procedures for secure deletion. It puts into practice the storage limitation principle of the UK...

Version 1 · Updated October 21, 2026 Read the policy

Sub-Processor List

The following third-party sub-processors are engaged by Subcontext Ltd to process data on behalf of customers.

Version 1 · Updated October 21, 2026 Read the policy

Data Subject Rights Procedure

This procedure explains how requests from individuals to exercise their rights under the UK GDPR are handled: access, rectification, erasure, restriction, portability and...

Version 1 · Updated October 21, 2026 Read the policy

Data Protection Impact Assessment

This is Subcontext's assessment of the data protection risks of the platform's core processing: AI agents holding conversations with our customers' customers, and the CRM and...

Version 1 · Updated October 21, 2026 Read the policy

Transfer Risk Assessment

Some of Subcontext's sub-processors process personal data in the United States. This assessment records how those restricted transfers are made lawful under the UK GDPR, and why...

Version 1 · Updated October 21, 2026 Read the policy

Enterprise Order Form

Fixed-term and negotiated plans are agreed on an Order Form under our Terms of Service. Here is the template we use.

PDF Word

Questions from your security or procurement team?

We're happy to answer questionnaires and talk through any of these policies.