Sub-processor List
Orthodoxy, Inc. · Last updated September 6, 2026
Customers under a Data Processing Addendum may subscribe by email to receive advance notice of changes to this list.
Orthodoxy, Inc. engages the following third-party sub-processors to process personal data on behalf of customers in connection with providing the Service. Each sub-processor is subject to contractual data protection obligations at least equivalent to those in Orthodoxy's Master Subscription Agreement and applicable Data Processing Addendum.
Anthropic, PBC
United StatesProcessing activityAI model inference — generating AI Output in response to Authorized User queries via the Claude API, including passage extraction, passage-conflict checks, digests of source documents uploaded by Authorized Users, and the hallucination-defense holding check. Token counts and model identifiers returned with each call are retained by Orthodoxy as service metering data.
Transfer safeguardAnthropic API Terms of Service; contractual commitment that Customer Content is not used to train models.
Supabase Inc.
United StatesProcessing activityRelational database, authentication, and file storage. All Customer Content and sign-off records are stored in Supabase-managed infrastructure.
Transfer safeguardData Processing Agreement; SOC 2 Type II certified.
Processing activityApplication hosting, serverless function execution, and CDN delivery.
Transfer safeguardData Processing Agreement; SOC 2 Type II certified.
Stripe, Inc.
United StatesProcessing activityPayment processing and subscription billing. Stripe processes billing contact information and payment instrument data. Stripe does not have access to Customer Content or matter data.
Transfer safeguardData Processing Agreement; PCI DSS Level 1 certified; SOC 2 Type II certified.
Processing activityTransactional email delivery, including account notifications, security alerts, and support communications.
Transfer safeguardData Processing Agreement.
Upstash, Inc.
United StatesProcessing activityRate-limit token bucket cache (user identifiers and request timestamps only; no Customer Content).
Transfer safeguardData Processing Agreement.
Functional Software, Inc. (Sentry)
United StatesProcessing activityApplication error and scheduled-job monitoring. Receives exception and stack-trace metadata, request identifiers, and internal firm/user identifiers, and browser session recordings sampled at 10% of sessions and 100% of sessions in which an error occurs. Recordings are captured with all page text and form input values masked and media blocked. Network request and response bodies are not recorded, and content fields are stripped from server error payloads before transmission. No Customer Content.
Transfer safeguardData Processing Agreement; SOC 2 Type II certified.
Change notifications
Orthodoxy provides at least 30 days' advance written notice before adding or replacing a sub-processor. Customers under a Data Processing Addendum may object to a new sub-processor on reasonable data protection grounds within the notice period.
To subscribe to sub-processor change notifications, email support@orthodoxyapp.com with the subject line "Sub-processor change notifications" and your firm's account email.
Questions? Contact support@orthodoxyapp.com