Sub-processor List

Orthodoxy, Inc. · Last updated September 5, 2026

Customers under a Data Processing Addendum may subscribe by email to receive advance notice of changes to this list.

Orthodoxy, Inc. engages the following third-party sub-processors to process personal data on behalf of customers in connection with providing the Service. Each sub-processor is subject to contractual data protection obligations at least equivalent to those in Orthodoxy's Master Subscription Agreement and applicable Data Processing Addendum.

Anthropic, PBC

United States

Processing activityAI model inference — generating AI Output in response to Authorized User queries via the Claude API, including passage extraction, passage-conflict checks, digests of source documents uploaded by Authorized Users, and the hallucination-defense holding check. Token counts and model identifiers returned with each call are retained by Orthodoxy as service metering data.

Transfer safeguardAnthropic API Terms of Service; contractual commitment that Customer Content is not used to train models.

Supabase Inc.

United States

Processing activityRelational database, authentication, and file storage. All Customer Content and sign-off records are stored in Supabase-managed infrastructure.

Transfer safeguardData Processing Agreement; SOC 2 Type II certified.

Vercel Inc.

United States

Processing activityApplication hosting, serverless function execution, and CDN delivery.

Transfer safeguardData Processing Agreement; SOC 2 Type II certified.

Stripe, Inc.

United States

Processing activityPayment processing and subscription billing. Stripe processes billing contact information and payment instrument data. Stripe does not have access to Customer Content or matter data.

Transfer safeguardData Processing Agreement; PCI DSS Level 1 certified; SOC 2 Type II certified.

Resend Inc.

United States

Processing activityTransactional email delivery, including account notifications, security alerts, and support communications.

Transfer safeguardData Processing Agreement.

Upstash, Inc.

United States

Processing activityRate-limit token bucket cache (user identifiers and request timestamps only; no Customer Content).

Transfer safeguardData Processing Agreement.

Functional Software, Inc. (Sentry)

United States

Processing activityApplication error and scheduled-job monitoring. Receives exception metadata, request identifiers, and internal firm/user identifiers; known personal-data fields are scrubbed before transmission; no Customer Content.

Transfer safeguardData Processing Agreement; SOC 2 Type II certified.

Change notifications

Orthodoxy provides at least 30 days' advance written notice before adding or replacing a sub-processor. Customers under a Data Processing Addendum may object to a new sub-processor on reasonable data protection grounds within the notice period.

To subscribe to sub-processor change notifications, email support@orthodoxyapp.com with the subject line "Sub-processor change notifications" and your firm's account email.

Questions? Contact support@orthodoxyapp.com