Subprocessors
Last updated: October 16, 2026
These are the companies that process data on DocketDrafter's behalf for DocketDrafter for Claude and ChatGPT and our support. "Customer content" means your drafts, uploaded files, form records, firm instructions, and matter information. Only the two founders have personnel access to it; the companies below process it for us.
We add a provider to this page before it starts handling customer content (ToS §9). To also be notified by email, write to support@docketdrafter.com.
Handle customer content
| Company | What they do for us | Data involved | Location | Certifications |
|---|---|---|---|---|
| Amazon Web Services | Stores your workspace repository and files; manages encryption keys | All customer content, encrypted | us-east-2 (Ohio) | SOC 2 Type II, ISO 27001, and others |
| E2B | Runs the isolated sandbox where your assistant's commands execute | A working copy of your firm's workspace while a session is active; deleted after 30 days without use | United States (Google Cloud us-west1, Oregon) | SOC 2 Type II |
| Railway | Hosts DocketDrafter's application servers and background-job queue | Customer content passing through the application, and a cached copy of each firm's workspace on disk (AES-256 encrypted at rest) | US East (Virginia) | SOC 2 Type II; third-party penetration test |
| ConvertAPI | Converts Word documents to PDF, and updates fields such as tables of contents and tables of authorities in Word documents | The document being converted; ConvertAPI deletes it within 3 hours | United States (Washington, DC and San Jose) | SOC 2 Type II, ISO 27001, and others |
| Slack | Delivers feedback reports to a private founders-only channel; copies expire after 30 days | Report text, which may include relevant document excerpts or matter context | United States | SOC 2 Type II; Slack states it does not train generative AI models on customer data |
| Anthropic | Inference provider for founders' AI tools used to configure, maintain, support, and operate workspaces | Tools can explore the entire workspace, including client documents and history; not limited to task-selected files | United States | SOC 2 Type II; business-plan terms prohibit training on customer content |
| OpenAI | Inference provider for founders' AI tools used to configure, maintain, support, and operate workspaces | Tools can explore the entire workspace, including client documents and history; not limited to task-selected files | United States | SOC 2 Type II; business-plan terms prohibit training on customer content |
| Baseten | Inference provider for founders' coding tools, including Pi; we use only GLM 5.3 Flash through Baseten for customer workspace work | Workspace content submitted by the agent, potentially including client documents and history; Model APIs inputs and outputs are not logged or stored (contractual zero data retention) | United States (GLM 5.3 Flash, per Baseten support; not other models) | SOC 2 Type II; its security practices, part of its terms, prohibit training on customer content |
| Granola | Transcribes calls, after notifying participants, for internal customer records, follow-up, and product feedback | Call content and transcripts, potentially including client or matter information; no audio or video retained unless asked | United States | SOC 2 Type II; model training disabled in our account; may use its own transcription and AI providers, listed in its security documentation |
| Google Workspace | Business email | Anything you email us | United States | SOC 2 Type II, ISO 27001 |
Handle account, usage, and scheduling data only
| Company | What they do for us | Data involved | Location |
|---|---|---|---|
| Clerk | Sign-in and multi-factor authentication | Names, emails, sign-in records | United States |
| Supabase | Account and organization database | Names, emails, firm, role, billing status | us-east-2 (Ohio) |
| Axiom | Application logs and performance monitoring | Request metadata and timings; no document content or command contents | United States |
| PostHog | Product analytics and session replay for the DocketDrafter web app | Page views and clicks; all on-screen text and form inputs are masked | United States |
| Stripe | Billing | Billing contact and payment details | United States |
| Cal.com | Scheduling calls with us | Name, email, and anything entered when booking | United States |
| Umami | Privacy-focused analytics for the docketdrafter.com website | Page views, with no cookies and no personal data | United States (Oregon), account-selected data region |