Pulscale Processing Register
Last updated 1 October 2026
This page describes where Pulscale processes customer personal data and the providers that process it on our behalf. We maintain this information as our provider arrangements change.
Hosting and remote access
By default, platform data storage and backups are hosted with AWS in the United Kingdom. Where a customer’s Order Form selects another location, that customer’s data and backups are hosted there.
Pulscale employees may access customer data remotely under clause 4.6 of the Data Processing Schedule. Contractors or other companies with access are listed below as subprocessors.
Access is limited to authorised personnel who need it to provide and support the platform, subject to confidentiality obligations and appropriate security controls. Remote access does not change the location of our primary hosting and backups.
External providers’ processing and access locations are identified separately below.
Platform providers and processing locations
Amazon Web Services
| Legal entity | Amazon Web Services EMEA SARL, Luxembourg. |
|---|---|
| Status | Active. |
| Purpose | Platform hosting and backups. |
| Data processed | Platform databases, documents, outputs and operational logs, including personal data within them, and associated backups. |
| Storage and backup country | United Kingdom by default, or the location selected in the customer’s Order Form. |
| AWS services locations | United Kingdom and European Union. |
| International transfer safeguards | No restricted transfer for UK and EU locations (UK adequacy regulations cover the EEA). Any other region: the AWS data processing addendum. |
| Retention | Backups are kept for approximately 30 days and all copies are deleted within 90 days of deletion from the live platform; no copies are kept outside the hosting region. Security logs are kept for 12 months. |
| Acceptable use policy | https://aws.amazon.com/aup/ |
Amazon Bedrock (AI processing)
| Provider legal entity | Amazon Web Services EMEA SARL, Luxembourg. |
|---|---|
| Status | Active. |
| Purpose | AI model processing through Amazon Bedrock. |
| Data processed | Prompts, extracts of customer documents and records needed for the requested output, and the outputs, including any personal data within them. |
| Processing and access countries | The location stated in the customer’s Order Form (by default, the same location as hosting). |
| International transfer safeguards | No restricted transfer for UK and EU locations (UK adequacy regulations cover the EEA). Any other location: the AWS data processing addendum. |
| Retention | Amazon Bedrock does not store prompts or outputs by default; where a model requires abuse detection, flagged requests are kept for up to 30 days. No training on customer data. |
| Acceptable use policy | https://aws.amazon.com/aup/ and https://aws.amazon.com/ai/responsible-ai/policy/ |
Support and consulting services
Customers should remove, anonymise or pseudonymise personal data before sending it for a support or consulting request and use the platform where practical (clause 2.4 of the Data Processing Schedule). Pulscale keeps support and consulting records and files with Amazon Web Services; data a customer chooses to send by email or Microsoft Teams is held in Microsoft 365. No group companies process customer data.
Amazon Web Services (support and consulting)
| Purpose | Support and consulting records and files, and the internal Pulscale systems used to handle them. |
|---|---|
| Processing and access countries | United Kingdom and European Union. |
Microsoft 365
| Legal entity | Microsoft Ireland Operations Limited, Dublin, Ireland. |
|---|---|
| Purpose | Email and Microsoft Teams, where a customer sends data for a support or consulting request. |
| Storage location | United Kingdom and European Union (currently the European Union). |
| International transfer safeguards | No restricted transfer for UK and EU storage (UK adequacy regulations cover the EEA). Any Microsoft access from elsewhere: the Microsoft Products and Services Data Protection Addendum. |
| Retention | Deleted when no longer needed for the request. |
How we protect customer data
Access is limited to authorised people who need it for their work and are subject to confidentiality obligations. Our safeguards include least-privilege access, multi-factor authentication for privileged and remote administrative access, encryption and security logging. Customer data is not used to train or fine-tune AI models by Pulscale or its AI providers.
Changes to this register
Changes are notified by email to affected customers and handled under clause 4 of the Data Processing Schedule.
Updating this page does not change a customer’s agreed contractual protections. Individual AI model versions may change within those protections without requiring a new agreement.
Change history
No changes since first publication. Previous versions are available on request.
PULSCALE LTD · Registered in England and Wales · Company number 17352743 · Registered office: 11 East Cliff, Pennard, Swansea SA3 2AS