"Vendor standard DPA" means we rely on that provider's own published Data Processing Agreement, which applies under their terms — not a separately negotiated, countersigned document we hold on file. For a specific vendor's current DPA status, email security@draftiro.com.
Supabase
- Purpose
- Database, file storage, authentication and sign-in emails
- Data received
- All firm and matter data (encrypted at rest); account emails for sign-in and verification
- Region
- AWS us-east-1 (United States)
- DPA
- Vendor standard DPA
Vercel
- Purpose
- Application hosting, CDN
- Data received
- HTTP requests; no persistent storage of matter content
- Region
- Global edge network
- DPA
- Vendor standard DPA
Google (Gemini API)
- Purpose
- AI responses, document text extraction and search indexing
- Data received
- Prompts, the matter context sent with them (case details, document excerpts, conversation history), uploaded documents for text extraction, and responses. Not used to improve Google's products; logged for a limited period for abuse monitoring. Google Search grounding is off by default
- Region
- Google-managed; may be processed outside the US
- DPA
- Vendor standard DPA
Microsoft (Graph API)
- Purpose
- Optional Microsoft 365 calendar, inbox and file integration
- Data received
- If you connect: calendar events, recent inbox message previews (sender, subject, short body preview), files you import from OneDrive/SharePoint, and email you send through Draftiro
- Region
- Your Microsoft 365 tenant
- DPA
- Vendor DPA · only if enabled
Stripe
- Purpose
- Payment processing
- Data received
- Billing contact and payment details. Draftiro does not receive or store your full card number
- Region
- Stripe-managed
- DPA
- Vendor standard DPA
Resend
- Purpose
- Transactional email delivery
- Data received
- Not currently enabled. When enabled: recipient email address and the email content (digests, alerts)
- Region
- Not currently enabled
- DPA
- Vendor DPA · only if enabled
Sentry
- Purpose
- Error tracking
- Data received
- Error reports: stack traces, page addresses and browser details. Request bodies are not sent and sensitive URL parameters are removed
- Region
- Sentry-managed
- DPA
- Vendor standard DPA
CourtListener (Free Law Project)
- Purpose
- Case-law search and citation checks
- Data received
- Short case-law search terms (with party and client names removed) and case citations detected in AI answers — not your full message
- Region
- United States (public service)
- DPA
- None — public service
Vercel Analytics
- Purpose
- Cookieless product analytics
- Data received
- Page views and a small set of product events (such as button clicks and help-search terms); no cookies
- Region
- Global edge network
- DPA
- Vendor standard DPA