Legal
Sub-processors
Effective September 4, 2026. Updated whenever we add or remove one.
These third parties help us deliver the service. Each is bound by a DPA. We provide 30 days' notice via email to workspace owners before adding a new sub-processor.
| Vendor | Purpose | Data | Region | Compliance |
|---|---|---|---|---|
| Supabase, Inc. | Database, auth, storage, edge functions | Confidential + Restricted | US | SOC 2 Type II, HIPAA-eligible |
| Vercel Inc. | Web app hosting, CDN, middleware | Internal + Confidential (in-flight) | US (Global CDN) | SOC 2 Type II, ISO 27001, PCI DSS AoC |
| Stripe, Inc. | Payments, connected accounts, fraud | PII + card data (Stripe scope, SAQ-A for us) | US | PCI DSS Level 1, SOC 2 Type II |
| Resend | Transactional email | Confidential (emails, names) | US | SOC 2 Type II |
| Anthropic PBC | AI drafting features (opt-in per tenant) | Confidential (prompts may include project text) | US | SOC 2 Type II, ISO 27001; contract prohibits training |
| Deepgram | Voice transcription for daily logs (opt-in) | Audio recordings | US | SOC 2 Type II |
| Voyage AI | Text embeddings for semantic search (opt-in) | Text excerpts of RFIs, logs | US | SOC 2 Type II |