Subprocessors.
The complete list.

Matter content goes to two of them

Your recordings, transcripts, fee notes, briefs, attendance notes and correspondence are processed only by Supabase (database and scanned pages) and Google Cloud (audio and document storage, and all AI inference), both in the EEA.

Matter content is notsent to Stripe, PostHog, or any analytics, marketing or advertising processor. Brevo delivers our emails, and the workspace activity digest may include a document’s subject line, but never a recording, a transcript or a document body. Matter content is not sold, rented or shared, and it is not used to train AI models.

Google Cloud is the sole AI processor

Every user-facing task that touches matter content (transcription, tidying, classification, formatting, filing suggestions, reading a photographed page) runs on Google Vertex AI. There is no fallback AI provider. If Vertex is unavailable, the feature waits; it does not quietly reroute to somebody else.

“Sole AI processor” is a statement about who we send data to, not about whose model runs. Vertex serves models from more than one developer, including Anthropic. Document formatting runs on Anthropic’s Claude, served by Google on the EU multi-region endpoint. The request still goes to Google, under the Google Cloud data processing addendum and our own service-account credentials. Google’s partner-model terms state that customer prompts and model responses are not shared with third parties, including partner models. Anthropic receives nothing from us and is not a subprocessor. If that ever stops being true, they appear in the table above before the code ships.

Not a subprocessor: Microsoft

Sign-in uses Microsoft OAuth. We receive an identity assertion (your name, email address and tenant identifier) from your own Microsoft tenant. Microsoft is an independent controller for your Microsoft account, not our processor, and it receives no matter content from us. It is listed here because the privacy policy names it and readers ask.

US ownership and the CLOUD Act

Five of our six subprocessors are US-headquartered groups. The position:

1. Region is contractual and real. All matter content is stored and processed in the EEA, and we verify it rather than take it on trust. Stripe and Vercel, which never receive matter content, may transfer the account, billing and website data they hold to the United States under their own data processing terms.
2. Region does not extinguish jurisdiction. The US CLOUD Act can in principle reach data held by a US provider’s foreign subsidiary. Choosing an EU region does not make a US-owned provider immune to a US order.
3. What actually protects the material is therefore not geography alone, but the providers’ published commitments to challenge overbroad orders and to notify customers where lawfully permitted; the Standard Contractual Clauses and supplementary measures in each agreement; and the protections legally privileged material carries in its own right.
4. We do not hold customer-managed encryption keys. A provider served with a valid order could technically produce plaintext. Customer-managed keys on the object store are the mitigation, and they are not implemented.

If customer-managed keys are a requirement for your chambers or instructing solicitors, tell us.

Changing this list

Adding a subprocessor is a decision we take deliberately, not a deployment detail. In order: a signed data processing agreement on file, this page and our internal register updated, the privacy policy updated, and, under the agreement we offer you, advance notice with a right to object.

Email hello@clerkand.com to be told in advance when this list changes, to raise an objection, or to ask for our data processing agreement, a transfer impact assessment, or a completed security questionnaire.