Sub-processor list

Supabase, Fly.io and Mistral AI can technically process the content of documents you upload, because processing that content is what they are there for. Vercel serves the application, and its server functions in Frankfurt handle document content in one place only: they decrypt the short excerpts around an entity that a reviewer opens on the review screen and pass them to that reviewer's browser, without storing or logging them. Stripe receives billing data only.

Resend receives the address an account email goes to and the text of that email, which is a sign-in link, a password reset, an invitation or a service notice. Google receives usage data from the public pages of this website and nothing from the signed-in application, so it is the one entry on the list that touches nothing belonging to a case.

Personal data that is dense in identifiers, specifically the text of each mention of a detected entity and the normalised document model, is encrypted on our servers before it is written, using a key held per case. A sub-processor holding that data at rest holds ciphertext.

Not all case data is encrypted under the case key, and what is not, Supabase holds in readable form in Frankfurt. Among it are the display name of each detected entity, which is the fullest spelling of that name, email address or identifier as it appeared in the documents and is shown on the review screen so that a reviewer can tell who is who, and the external reference you give a case, which may identify a person. Clause 7.2 of the Data processing agreement lists every such field, and says that each one survives a purge in a database backup for as long as that backup can be restored, which is seven days. We plan to encrypt the display name under the case key.

Systems you connect to the service so it can retrieve your documents, such as Microsoft SharePoint through the storage connection an administrator of your organisation authorises, are not our sub-processors. They process your documents for you, under your own agreement with that provider, before and independently of anything we do. The connection uses delegated access that your organisation consents to, limited to reading, and revocable by you in your provider's own admin portal at any time.

The only artifact of such a connection we store is the delegated refresh credential, encrypted at rest with a key the browser never receives. Documents retrieved through a connection are processed under the Data Processing Agreement exactly as documents you upload by hand.

All processing of customer personal data takes place within the European Union. We do not transfer customer personal data outside the European Economic Area in the ordinary course of providing the service.

Some sub-processors are incorporated outside the EEA even though the processing runs inside it. Where a corporate structure creates the possibility of access from a third country, that access is governed by the European Commission's Standard Contractual Clauses together with supplementary technical measures, principally the encryption described in clause 1.1. A copy of the safeguards in place is available on request.

One entry's own processing does take place outside the European Economic Area, and the first paragraph still holds because that entry holds no customer personal data. Google Analytics runs on Google's global infrastructure, including the United States. Google Ireland Limited is the party we contract with, and the transfers are governed by the Standard Contractual Clauses that Google's own data processing terms incorporate. What travels is the public website usage data described in clause 2.5 of the Privacy notice, and nothing from the product.

We will give customers at least thirty days' written notice before adding or replacing a sub-processor, so that there is time to object before the change takes effect.

A customer may object on reasonable data protection grounds within that period. If we cannot offer a workable alternative, the customer may terminate the affected subscription without penalty and receive a pro rata refund of prepaid fees.

To receive notice of changes, subscribe by writing to privacy@pritect.ai with the subject line "Sub-processor notifications".

Every change is also published to a feed at veil.pritect.ai/trust/subprocessors/feed.xml, which any feed reader can watch without telling us anything about you. The feed carries the same entries as section 4 and nothing else.

Every addition to this list, and every replacement of a sub-processor on it, is recorded below with the date we published the change and the date the notice period in clause 3.1 ended. The two changes of 10 September 2026 were made before this service had any customer, so no notice was owed to anyone under clause 3.1; we ran the thirty days regardless and the dates below record it.