List of subprocessors

• Railway (United States) — Platform hosting: the servers, the database, the task queue and their backups. It is the processor that hosts every piece of data the platform stores. Safeguard: data processing agreement incorporated into its own terms of service (railway.com/legal/dpa, consulted on September 4, 2026). Retention: the platform's own; the provider declares no separate period.
• Resend (United States) — Transactional email delivery: it receives your email address and the content of the notices. Safeguard: data processing agreement incorporated into its terms (resend.com/legal/dpa, consulted on September 4, 2026).
• Polar.sh (United States) — Payment gateway and billing: it receives the contact email and the name of the firm. Safeguard: data processing agreement incorporated into its terms (polar.sh/legal/data-processing-addendum, consulted on September 4, 2026).
• Nebius B.V., a Dutch company domiciled at Schiphol Boulevard 165, 1118 BG Schiphol, the Netherlands, which operates the Nebius Token Factory service (the Netherlands; inference in the European Union, in Israel or in the United States depending on the model) — Text generation with the GLM-5.3-Flash model for the Artificial Intelligence features, and generation of the vector representations (embeddings) of the text of your documents with the Qwen3-Embedding-8B model, which runs in the European Union (Finland) and makes the semantic search of the cited-answer feature (Q&A) possible. Until September 24, 2026 the embeddings were computed by Voyage AI (United States), which ceased to be a sub-processor on that date. Governing law: that of the Netherlands; forum: the courts of Amsterdam. Safeguard: data processing agreement incorporated into its terms of service, with the Standard Contractual Clauses of Implementing Decision (EU) 2021/914 for transfers outside the European Economic Area. Retention: the next section describes it in full.
• Sentry (United States) — Technical error monitoring: it receives the route where the error occurred and your internal user identifier; before sending each event we strip your email, your name and your IP address. Safeguard: data processing agreement incorporated into its terms (sentry.io/legal/dpa, consulted on September 4, 2026).
• Cloudflare (United States) — Delivery and protection network for the site and the application: all traffic between your browser and us passes through its network, so it processes the IP address and the metadata of each connection in transit; it also controls access to our internal documentation. Since September 19, 2026 it also runs the anti-abuse verification of the no-account case lookup (Cloudflare Turnstile): when somebody uses that lookup, their browser talks directly to Cloudflare, which for that check processes — according to its own Turnstile privacy policy, consulted on September 19, 2026 — the IP address, the TLS fingerprint, the User-Agent header and the site's public key with its origin, and states that it cannot directly identify an individual from those signals. That verification writes no cookie: Cloudflare publishes that Turnstile does not use cookies to collect or store information of any kind, and the cf_clearance cookie is only issued with "pre-clearance" enabled, which is off on our widget. It also measures with Cloudflare Web Analytics, in aggregate figures, the pages viewed —which address, which site the visit came from, which type of browser and device, and how long the page took to load—; that measurement writes no cookies, does not use the browser's local storage and assigns the browser no identifier, and like any web request it carries the IP address. Safeguard: data processing agreement v6.4, in force since April 3, 2026, incorporated by reference into the subscription contract, which requires notification of an incident without undue delay.
• Google LLC (United States) — Measurement of the use of the public site with Google Analytics 4, on the pages of the public site and, in the application, only at the instant an account is created, when it receives a single sign-up event (sign_up) with the method and no identifier of the person or the firm: it receives which pages and guides are visited, how far they are scrolled, which links lead out to other sites, which videos are played and which files are downloaded, with the IP address and the technical data of the browser; and, only after "Accept all" in the cookie notice, the identifiers of the _ga and _ga_<id> cookies. Without that consent it runs with analytics denied and only sends cookieless pings. Site search measurement and form interaction measurement, the options to share Analytics data with Google for its own purposes, and Google signals are turned off; the property is linked to our Google Ads account to see metrics and to count the sign-up as a conversion, with no audiences and no remarketing. It receives no data a firm uploads to the platform, which is why it is not part of the chain of sub-processors sealed into the processing agreement. Safeguard: Google's processor terms (Google Ads Data Processing Terms), which cover Google Analytics and which we accepted in the account before turning the measurement on. Retention: fourteen (14) months, the period we set in the property; after that period Google deletes the event and user data.
• Oracle America, Inc., a United States company with its address for notices at 500 Oracle Parkway, Redwood Shores, California 94065, United States, which operates Oracle Cloud Infrastructure (Brazil: the virtual machine runs in its São Paulo region; Oracle may access from other countries for support, incident management or recovery) — Network exit to Brazil's Diário de Justiça Eletrônico Nacional (DJEN), only for the queries of firms whose country is Brazil: those the platform makes to the DJEN by OAB registration numbers and by the names of the parties the firm monitors go out through a virtual machine that only lets connections through to the DJEN's two official servers. The content travels encrypted with end-to-end TLS between our platform and the DJEN, so Oracle does not read it; it does process each connection's metadata: IP addresses, the name of the destination server, times and sizes. Active since October 14, 2026: since that day the DJEN queries of firms in Brazil go out through this machine, and through no other. Governing law: that of the State of California; forum: the courts of San Francisco or Santa Clara counties. Safeguard: Oracle's online Cloud Services Agreement (version v062223_US_ENG), whose §5.2 b) incorporates by reference the Data Processing Agreement for Oracle Services of August 14, 2025 and its transfer annex (Data Transfer and Additional Jurisdiction Specific Terms Annex, version v060225), which, for data subject to Brazilian law that leaves Brazil, refers to the cláusulas-padrão contratuais of Resolução CD/ANPD nº 19/2024; published versions, consulted on October 14, 2026. Retention: the machine does not store the content of the queries or of the responses; we have not established how long Oracle keeps the network metadata it processes, and on termination of the service its agreement obliges it to return and delete the personal data left on its systems.
• Alternate text generation providers, registered and with no traffic today: Anthropic (United States) and JINGSHENG HENGXING TECHNOLOGY PTE. LTD., domiciled at 10 Anson Road #26-03, Singapore, which operates the z.ai service. Neither of the two receives your data: the platform keeps their connection configured so it can fall back to them if the generation provider stops being available. Activating one would change the processor and the jurisdiction of the transfer, so we would not do it without raising the version of the privacy policy and asking you for a new authorization. Declared retention: Anthropic normally deletes inputs and outputs within thirty days, with the exceptions it publishes; z.ai declares that it does not store API content.

For three of them we publish the full legal entity and its domicile, because they are the ones that declare it in the instruments that govern the engagement: Nebius B.V., Oracle America, Inc. and JINGSHENG HENGXING TECHNOLOGY PTE. LTD. For the rest we publish the name under which they contract and the country from which they provide the service, which is what their own terms declare; we do not invent a corporate name the source does not publish.

We do not claim to have negotiated with any of them clauses different from the ones their own terms incorporate, nor that they hold security certifications we have audited. What we do have, and archive, is each one's data processing agreement: with Railway, also signed separately by both parties (October 9, 2026); with Sentry, accepted electronically in its version 5.1.0 (October 10, 2026); with Oracle, the one its Cloud Services Agreement incorporates by reference, in the version Oracle publishes; with the others, the one their own terms incorporate.

What we do claim, and it is the opposite of hiding behind a list: we answer for them as if they were us. When the contracting firm is domiciled in Brazil, the data processing agreement adopts the cláusulas-padrão contratuais of Annex II to Resolução CD/ANPD nº 19 of 23 August 2024, and its Clause 18.2, c) states that the importer «será considerado o responsável por eventuais irregularidades praticadas pelo terceiro destinatário da Transferência Posterior». That is not a referral: it is our direct liability towards the Brazilian data subject for whatever any subprocessor on this list does. The same clause, in its point b), requires us to guarantee by written contractual instrument that the safeguards of those clauses reach them, and it is why every row above names the instrument the transfer travels under instead of saying «agreement in force». A subprocessor whose safeguard cannot be named does not go on this list. Where there is a transfer, those instruments carry the European Union standard contractual clauses; only Oracle's refers to the ANPD cláusulas-padrão, and only for data that leaves Brazil, so the direct liability of point c) is the guarantee we give you over all of them.

Zero data retention is enabled in our organization with the text generation provider since September 4, 2026. According to what that provider publishes, with zero data retention enabled the inputs (the text sent to it) and the outputs (the text it returns) are not stored in its systems after each request is processed, are not used for speculative decoding and are not used to train, fine-tune or improve any model, its own or a third party's; the option applies at the organization level and covers all of its projects and endpoints (published Nebius legal guide, «Legal Quick Guide», consulted on September 4, 2026 on the provider's documentation site).

We also tell you, with the same precision, what that guarantee does NOT settle: it is a statement published by the provider and not a control we have audited; it operates going forward and does not reach submissions made before 4 September 2026, over which the default processing of its terms of service continued to apply; its published documents do NOT say whether Zero Data Retention reaches any records the provider may keep to detect abuse of the service, nor whether it applies in the same way to responses delivered as a stream, so we claim neither of those two things; and enabling it is up to us, so if we ever disabled it we would update the privacy policy before doing so.

The provider publicly declares ISO 27001, ISO 27701 and SOC 2 Type II certifications and publishes the list of its own subprocessors, but that is a statement of its own that we have neither audited nor verified against the certificates.

This list is reviewed at least once a year and, in addition, every time a subprocessor enters, leaves or changes, one of them changes jurisdiction or changes its retention configuration. The date of the last review is the one at the top of this document.

When the change alters who processes your data or where, updating this list is not enough: the privacy policy moves up a version and the platform asks you for a new authorization over the text in force, as its section 12 promises. When the change only narrows what an already authorized subprocessor retains, this list is updated and the policy says so, without asking you again.