Legal
Sub-processors
Last updated: 2026-05-21
The third parties below process small amounts of engagement metadata or derived content under our Data Processing Agreement. The principle: no single third party sees the full customer dataset; document content is ephemeral; aggregate research data is irreversibly hashed.
| Processor | Purpose | Privacy |
|---|---|---|
| Supabase | Database + authentication (Frankfurt region) | link |
| Vercel | Web application hosting (EU region) | link |
| Anthropic | AI clarification + generation + review (commercial API; non-training default) | link |
| Google (Drive API) | Document folder access (read-only OAuth; content not stored) | link |
| Resend | Transactional email delivery | link |
| Inngest | Background job orchestration (metadata only — no customer content) | link |
V1.1 additions: Stripe (when card payment is added — currently invoice-only); Microsoft Graph (when SharePoint folder support is added — currently Google Drive only).