Submission Desk · Legal
Subprocessors
1.Current subprocessors
These vendors process data on our behalf to provide the Service. Each is bound by written terms that protect your data and restrict its use.
| Vendor | Purpose | Data processed | Location | Privacy |
|---|---|---|---|---|
| Supabase, Inc. | Managed Postgres database and S3-compatible file storage | All account data and Customer Data, including uploaded documents | United States (us-east-2) | supabase.com/privacy |
| Cloudflare, Inc. | Network security, secure tunnel, and content delivery | Data in transit to and from the Service; IP addresses and request metadata | Global network | cloudflare.com/privacypolicy |
| Anthropic, PBC | AI extraction and drafting, only when in-app AI is used with our API key | Document text and related Customer Data sent for that request | United States | anthropic.com/legal/privacy |
| Microsoft Corporation | Sign-in (Microsoft identity platform) and Outlook drafts via Microsoft Graph, on your behalf | Account identifiers; draft and sent-message content in your own mailbox | Per your Microsoft 365 tenant | privacy.microsoft.com |
| [Application hosting provider] | Runs the application servers and background workers | All data processed by the application in memory and in transit | [United States] | [link] |
2.Services you connect yourself
When you use the Claude connector or your own Anthropic API key, Anthropic provides that service to you under your own agreement with Anthropic, so it is your vendor rather than our subprocessor for that processing. Likewise, your Microsoft 365 mailbox is governed by your agreement with Microsoft; we act within it only with the permissions you grant. See AI Use & Transparency.
3.How we notify you of changes
We will update this page and email account owners at least 30 days before a new subprocessor begins processing Customer Data (or as soon as possible in an emergency, such as replacing a failed vendor). You may object on reasonable data protection grounds as described in the DPA. To ask a question or subscribe additional contacts, email [privacy@yourdomain.com].