Legal
Subprocessors
Version 2026-10-subprocessors-4 · Effective 2026-10-12
The third parties Clause50 uses to help provide the service.
Subprocessors
These are the third parties we currently use, or plan to use, to provide the service.
| Subprocessor | Purpose | Data categories | Data location | Transfer basis | Status |
|---|---|---|---|---|---|
| Vercel | Application hosting / edge | All request data in transit; platform request logs | Functions pinned to fra1 (Frankfurt, EU) | Contracting entity Vercel Inc. is US-established (Delaware); its DPA states its primary processing facilities are in the United States — covered by EU Standard Contractual Clauses (2021, Modules One–Three) and the UK IDTA, binding automatically on acceptance of Vercel's Terms | Active subprocessor |
| Supabase (managed PostgreSQL) | Primary database | Account, system, evidence, and artifact metadata | AWS eu-central-1 (Frankfurt, EU) | Contracting entity Supabase, Inc. is US-established. Its DPA is incorporated by reference into Supabase's Terms of Service (no separate signature required) — the specific ex-EEA transfer mechanism has not been independently verified from that text | Active subprocessor |
| Cloudflare R2 (object storage) | Evidence and artifact object storage | Uploaded evidence bytes; generated documents | Cloudflare EU jurisdiction — objects are stored and served only from EU data centres, a hard placement guarantee | Contracting entity Cloudflare, Inc. is US-established; its DPA covers any ex-EEA transfer of account/billing metadata (distinct from the R2 object bytes themselves) via EU SCCs or Cloudflare's EU-U.S. Data Privacy Framework certification | Active subprocessor |
| Resend | Transactional email (sign-in links, alert digests, one-off free-scan results) | Recipient email address; message content | Sending region eu-west-1 (Ireland, EU) | Contracting entity Plus Five Five, Inc. (San Francisco) is US-established and its DPA §6.1 states its primary processing occurs in the United States — covered by EU Standard Contractual Clauses (Module Two) and Resend's EU-U.S. Data Privacy Framework certification | Active subprocessor — DPA incorporated by reference on account creation (Resend's Terms of Service), no separate signature required |
| Gotenberg (hosted on Render) | DOCX → PDF conversion of generated artifacts | Full document bytes, transiently, during conversion | Workload runs in Render's Frankfurt (EU Central) region | Contracting entity Render Services, Inc. (San Francisco) is US-established and its DPA §6.1 states its primary processing occurs in the United States — covered by the EU-U.S. Data Privacy Framework, with EU Standard Contractual Clauses as the contractual fallback | Active subprocessor — third-party-hosted, so document bytes leave our own infrastructure during conversion |
| Google (sign-in with Google) | Optional sign-in: lets you authenticate with your Google account instead of an emailed link. Used only if you choose that button | That you signed in to Clause50 and when. We receive back your Google profile: verified email address, name and profile picture | Determined by Google; Clause50 does not control where Google processes sign-in data | Google LLC is US-established; for sign-in data it relies on its own transfer mechanisms (EU Standard Contractual Clauses and its EU-U.S. Data Privacy Framework certification), which we have not independently verified from Google's current terms. Google acts under its own terms and privacy policy for the sign-in itself | Active — optional. Sign-in by emailed link is always available without Google |
| Polar Software, Inc. | Payment processing and merchant of record (checkout, invoicing, VAT/tax remittance, chargebacks) | Billing/payment details, name, email, billing address, purchase history | Processes payments globally, including for EU customers | US-established | Active subprocessor and merchant of record for paid plans |
| Stripe | Payment processing infrastructure underlying Polar (sub-subprocessor — we have no direct relationship with Stripe) | Billing/payment details, processed on Polar's behalf | Global, on Polar's behalf — we have no direct relationship with Stripe to confirm further | US-established | Active sub-subprocessor (via Polar) |
| Anthropic | AI-assisted drafting: optional, switched on per system by the customer; drafts text and suggests follow-up questions from the answers recorded for that system | The drafting answers recorded for that system (business and technical descriptions of the AI system, free text); the system and organisation name | Not stated in Anthropic's DPA; Clause50 does not request EU-only processing, so treat it as processing outside the EEA, including the United States | Contracting entity Anthropic, PBC is US-established; its DPA is incorporated into its Commercial Terms and incorporates EU Standard Contractual Clauses (Modules Two and Three). Anthropic may not train models on this content; it deletes inputs and outputs within 30 days by default, longer only if flagged for a usage-policy violation | Planned: used today only in a trial on Clause50's own test data. We will update this row and notify customers with a signed DPA before any customer's data is sent |
Customer-directed integrations — not our subprocessors
GitHub, OpenAI, and Anthropic as connectors are not Clause50 subprocessors. When you connect one of these, you supply your own credential and we read data back from your own account on your instruction — the relationship is between you and that vendor, not us. Anthropic is listed above separately, for a different purpose: the optional AI-assisted drafting feature, where Clause50 itself sends data to it.
Changes to this list
We will update this page, and notify customers with a signed DPA, before adding a new subprocessor — not after.