Subprocessors
Effective July 17, 2026. This page describes how ClauseMinds approaches these topics for transparency. It is not legal advice; have counsel review for your organization.
What this page is
ClauseMinds uses a small number of third-party subprocessors to provide the service. This page names each one, what it does for us, what categories of data it can touch, and where it processes data. It is incorporated by reference into our Data Processing Addendum.
Current subprocessors
| Subprocessor | Purpose | Data it can touch | Processing location |
|---|---|---|---|
| Supabase | Primary database, user authentication, and encrypted file storage | Contract files, extracted contract data, account and workspace data | United States (region configurable for enterprise deployments) |
| Railway | API and background-worker hosting, job queue (Redis) | Contract content in transit and during processing | United States / European Union (Railway-managed regions) |
| Vercel | Web application hosting and content delivery | Application traffic; contract content in transit during use of the app | Global edge network; primary compute in the United States |
| OpenAI | Language-model analysis (extraction, contract Q&A, drafting assistance) | Contract text sent for analysis via the OpenAI API. API data is not used to train OpenAI models under OpenAI's API terms. | United States |
| Stripe | Payments and subscription billing | Billing contact details and payment records. Never contract content. | United States |
| Resend | Transactional email (notifications, reminders, digests) | Recipient email addresses and notification text. Never contract files. | United States |
| PostHog | Product usage analytics (only when analytics is enabled) | Usage events and page interactions. Not contract file content. | United States / European Union (cloud region dependent) |
Changes to this list
We update this page before engaging a new subprocessor that will process customer contract content. Customers with an executed Data Processing Addendum receive notice of material changes and may object as described in the DPA. The effective date above reflects the most recent change.
Enterprise deployments
Customer-owned deployments run the database, storage, and authentication inside cloud projects your organization controls, which removes or replaces several entries above. See customer-owned deployment or contact us to discuss requirements.