Subprocessors.
The complete list.

Matter content goes to two of them

Your dictations, transcripts, fee notes, briefs, attendance notes and correspondence are processed only by Supabase (database and scanned pages, Ireland) and Google Cloud (audio and document storage in Belgium; all AI inference in the EEA).

Matter content is not sent to Stripe, PostHog, Brevo, or any analytics, marketing or advertising processor. It is not sold, rented or shared, and it is not used to train AI models.

Google Cloud is the sole AI processor

Every user-facing task that touches matter content — transcription, drafting, classification, formatting, filing suggestions, reading a photographed page — runs on Google Vertex AI. There is no fallback AI provider. If Vertex is unavailable, the feature waits; it does not quietly reroute to somebody else.

“Sole AI processor” is a statement about who we send data to, not about whose model runs. Vertex serves models from more than one developer, including Anthropic’s — document formatting runs on Claude Opus 5, served by Google on the EU multi-region endpoint. The request still goes to Google, under the Google Cloud data processing addendum and our own service-account credentials. Google’s partner-model terms state that customer prompts and model responses are not shared with third parties, including partner models. Anthropic receives nothing from us and is not a subprocessor. If that ever stops being true, they appear in the table above before the code ships.

Not a subprocessor: Microsoft

Sign-in uses Microsoft OAuth. We receive an identity assertion — your name, email address and tenant identifier — from your own Microsoft tenant. Microsoft is an independent controller for your Microsoft account, not our processor, and it receives no matter content from us. It is listed here because the privacy policy names it and readers ask.

US ownership and the CLOUD Act

Five of our six subprocessors are US-headquartered groups operating through EU entities in EU regions. The accurate position, in the order a reviewer usually asks it:

1. Region is contractual and real. Data is stored and processed in the EEA, and we verify it rather than take it on trust.
2. Region does not extinguish jurisdiction. The US CLOUD Act can in principle reach data held by a US provider’s foreign subsidiary. Choosing an EU region does not make a US-owned provider immune to a US order.
3. What actually protects the material is therefore not geography alone, but the providers’ published commitments to challenge overbroad orders and to notify customers where lawfully permitted; the Standard Contractual Clauses and supplementary measures in each agreement; and the protections legally privileged material carries in its own right.
4. We do not hold customer-managed encryption keys. A provider served with a valid order could technically produce plaintext. Customer-managed keys on the object store are the mitigation, and they are not implemented.

Point four is the one most likely to be challenged in a due-diligence review, which is exactly why it is here rather than in a footnote. If it is a blocker for your chambers or your instructing solicitors, tell us — it is a roadmap question, not a secret.

Changing this list

Adding a subprocessor is a decision we take deliberately, not a deployment detail. In order: a signed data processing agreement on file, this page and our internal register updated, the privacy policy updated, and — under the agreement we offer you — advance notice with a right to object.

Email hello@clerkand.com to be told in advance when this list changes, to raise an objection, or to ask for our data processing agreement, a transfer impact assessment, or a completed security questionnaire.