How we choose suppliers

Like most companies, we aren't in the business of running mail servers or building office suites. This means we have to buy some software and services from other companies. We try to do this in a way that causes as little harm as possible.

We seek to strike a balance between buying services from smaller, European technology companies, maintaining our high standards of accessibility and keeping personal or commercially sensitive information secure. Whenever we choose a new tool or service provider, we will consider:

• Can we support local or European businesses?
• Can the supplier give assurance about accessibility?
• If the tool handles customer data or commercially sensitive data, will the data stay inside the European Union? Beyond this, how finely can we control access to it?

It’s rare for any one option to meet these requirements perfectly, so every decision is a compromise, on a case-by-case basis. For example:

• When we chose an e-mail and IdP service, we settled on Microsoft’s offering, due to their commitment to accessibility and option to keep data inside the EU, even though they are a major American technology company.
• When choosing where to run our customer-facing digital services, we were able to meet our needs using Bunny.net, who are a European company and give extensive control of where data are stored.

We generally avoid the major cloud platforms, except when they are used to deeply integrate into our customers’ existing infrastructure which already runs on them. For example, when a customer has an archive of documents already stored in Amazon Web Services, we will use the platform to access them and deliver repaired versions, rather than copying them to and from a separate service).