Subprocessors
A subprocessor is a third party we use to deliver Draftiro. Each row below lists what data the vendor receives, where they process it, and whether we have a Data Processing Agreement on file.
Last updated: 2026-05-29 · Email security@draftiro.com to subscribe to subprocessor change notifications.
| Vendor | Purpose | Data received | Region | DPA |
|---|---|---|---|---|
| Supabase | PostgreSQL database, file storage, auth | All firm + matter data (encrypted at rest) | AWS us-east-1 | |
| Vercel | Application hosting, CDN | HTTP requests, no persistent storage of matter content | Global edge | |
| Google (Gemini API) | AI inference | Prompts + generated responses (no training, stateless) | us-central1 | |
| Microsoft (Graph API) | Optional Outlook calendar + email integration | Calendar events + email metadata for connected users | User's tenant region | |
| Stripe | Payment processing | Billing details (we never see card numbers) | us-east-1 | |
| Resend | Transactional email delivery | Recipient email + email body (digests, alerts) | us-east-1 | |
| Sentry | Error tracking | Stack traces (PII redacted) | us-east-1 | |
| CourtListener (Free Law Project) | Citation validation | Case citation strings only | Public legal database | Public API |
| Crisp | Optional in-product support chat | Visitor email + message body | eu-west-1 | |
| Vercel Analytics | Cookieless page-view analytics | Anonymized page-view metrics | Global edge |
Need a DPA?
We countersign Draftiro's standard Data Processing Agreement (modelled on the EU SCCs) for any customer on a paid plan on request. Custom redlines accepted on Practice and Enterprise.
Request a DPASubprocessor change notifications
We notify subscribers by email at least 30 days before adding a new subprocessor. Reply to the email to object before the change takes effect.
Subscribe to change notifications →