Subprocessors

Third-party providers processing data on our behalf, with processing region and transfer mechanism. Changes are notified 30 days in advance.

ProviderPurposeRegionTransferStatusSince
Fly.ioapplication compute (web + worker)EU region (ams/fra)DPA + SCC where applicableplanned20 Sept 2026
OpenAI (Responses API)structured extraction, matching review, draftingEEA+Switzerland data residency (contract required)DPA + Modified Retention amendment requiredplanned20 Sept 2026
Resendtransactional emailUS/EU (SCC)Resend DPAplanned20 Sept 2026
Stripepayments, invoices, customer portalEU/US (SCC)Stripe DPAplanned20 Sept 2026
Supabase (Auth, PostgreSQL, Storage)identity, database, private object storageEU (region selected at deployment)intra-EEAplanned20 Sept 2026