Sub-processors
Last updated: 2026-10-02
Every provider that can receive customer or firm data through EstateDraftFL — what it does, what reaches it, and when it is used. Cross-checked against the platform's environment register on every build.
How to read "when used"
- always on — the platform cannot run without it
- on by default — used for every tenant unless a firm turns it off
- firm-enabled — reaches data only after a firm activates it with its own credentials
- reviewed-not-reached — the code exists; no credential is configured, so no data reaches it
The register
| Provider | What it does | What reaches it | When used |
|---|---|---|---|
| SupabaseData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Database, authentication (magic links), private object storage — the system of record. | Every stored record: accounts, matters, intake facts, uploaded documents, artifacts, audit events. | always on |
| VercelData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Hosting, edge network, serverless functions, crons, Web Analytics and Speed Insights (page-level, no PII). | Every request and response in transit; request metadata and performance timings. | always on |
| AnthropicData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | The governed AI engine (Opus 5 and, when priced, Fable 5) behind the firm workspace, the firm engines and the one-time statute cards. | The text a firm submits to an engine (documents, facts, questions) and the engine's reply; never a consumer's document (the self-help lane has no model surface). | on by default |
| SquareData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Hosted checkout, subscriptions, refunds and disputes — the live payment rail. | Buyer identity and payment details entered on Square's own pages; the order reference and amount; webhook events back to us. | always on |
| ResendData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Transactional email (receipts, notices, sign-in links, ops alerts) and, once the webhook secret is set, delivery events. | Recipient addresses and the message bodies we send. | always on |
| ImprovMXData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Inbound mail forwarding for the platform's own addresses (security@, support@). | Mail sent to those addresses. | always on |
| OpenTimestamps public calendars (a.pool.opentimestamps.org, a.pool.eternitywall.com)Data-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Timestamp the daily Merkle root of the ledger chains so anyone can prove the record existed by a Bitcoin block. | One 32-byte hash of hashes a day, and the proof's own commitments when it is upgraded — no customer, firm or matter data. | always on |
| Blockstream Esplora · mempool.space (public block explorers)Data-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Read a Bitcoin block header's Merkle root to confirm an anchor proof before the platform calls it confirmed. | A block height and a block hash — public Bitcoin data only. | always on |
| Free Law Project (CourtListener)Data-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Case-citation existence checks for the firm cite-check panel. | The case citations found in a firm's brief (citations only, never the brief). | on by default |
| PostmarkData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | An alternative transactional-mail provider. | Nothing — no token is configured; the adapter is dormant. | reviewed-not-reached |
| A private malware-scanning destination (owner-approved)the owner's approved provider terms (recorded at arming) | External malware verdicts on uploaded bytes when the owner arms the quarantine's scanner. | Nothing today — no scanner is configured; when armed, the raw bytes of an upload. | reviewed-not-reached |
| OpenAIData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | The alternate workspace engine (ChatGPT 5.6 Sol) and the dual consensus mode, through the same governed gateway. | Nothing today — no key is configured; when armed, the firm text submitted to that engine. | reviewed-not-reached |
| StripeData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | An alternate payment rail with the same webhook contract. | Nothing — keys absent by design; Square is the live rail. | reviewed-not-reached |
| TwilioData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | SMS deadline reminders. | Nothing — no sender is configured; when armed, the recipient's phone number and the reminder text. | reviewed-not-reached |
| Cloudflare TurnstileData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | A bot challenge on the public forms. | Nothing — no site key is configured; when keyed, the visitor's challenge token. | reviewed-not-reached |
| ClioData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Practice management: a firm's matter linked to its matter in the firm's Clio, and approved packet versions exported to it (master plan Phase 15). | Only after a firm connects its own Clio account: the search a staff member types to find the matter, and — for each export the firm approves — that version's firm-archive packet (a PDF) with its file name, filed under the linked Clio matter. No contact or matter is created in Clio. | firm-enabled |
| DocuSignData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | E-signature for firm documents outside the execution formalities — never a will, trust, power of attorney or health care directive (master plan Phase 15). | Only after a firm connects its own account: the document sent (its exact bytes) with its title, and each signer's name and e-mail address; DocuSign's status reports and the executed copy come back. | firm-enabled |
| PlaidData-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | Read-only bank and asset visibility for funding checks. | Only after a firm connects: account and balance data for the linked institutions. | firm-enabled |
| Google (Calendar API)Data-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | OAuth push of the dates a firm confirmed into its Google calendar. | Only after a firm connects: for each date the firm confirmed, the step's title with the matter's name, the date, and how it was reached — the rule and its edition, the event the count starts from and its date, the counting method, and who confirmed it and when; and a one-way identifier for the step, so a repeated push finds the event it made. | firm-enabled |
| Microsoft (Graph calendar)Data-protection terms (Opens in a new windowSe abre en una ventana nuevaLouvri nan yon nouvo fenètОткроется в новом окнеנפתח בחלון חדש) | OAuth push of the dates a firm confirmed into its Microsoft 365 calendar. | Only after a firm connects: for each date the firm confirmed, the step's title with the matter's name, the date, and how it was reached — the rule and its edition, the event the count starts from and its date, the counting method, and who confirmed it and when; and a one-way identifier for the step, so a repeated push finds the event it made. | firm-enabled |
| Thomson Reuters (Westlaw KeyCite) · LexisNexis (Shepard's)the partner's provisioning agreement (none today) | Citator treatment inside a firm's own entitlement. | Nothing — dormant until a partner provisions credentials; then the citations to check. | reviewed-not-reached |
The two honest AI paragraphs
Which AI vendor sees a firm's text is enforced, not merely promised: every model call passes through one gateway whose model allowlist is exact, so a run cannot reach an engine that is not configured and named here. The self-help consumer lane has no model surface at all — a consumer's documents are assembled from their own answers and never sent to an AI vendor.
Retention at the AI vendor is the vendor's declared posture under its commercial terms (the links above), which this platform does not observe or audit; the platform's own record of each call is metadata (surface, sizes, cost) and never the text. When the owner arms an additional engine or scanner, this register changes before the first byte reaches it.