These are the third parties that may process personal data on our behalf, and what each one is for. The list is short on purpose: every entry is somebody else who can be compromised.
Infrastructure
Cloud hosting and object storage, United States. Runs the application, the database and the document store. Sees everything, encrypted at rest, and is the only entry on this list that does.
Payments
Stripe, United States and Ireland. Two separate arrangements. Client payments to a firm settle to that firm's own connected account; aiylum's own subscription billing is a different merchant relationship. Stripe sees the payer's name, the amount and the card details. It does not see the case.
Card numbers never reach us. They are entered into Stripe's own fields and we hold a token.
Email delivery
Transactional email provider, United States. Delivers sign-in codes, portal invitations and notifications. Sees the recipient's address and the message body.
This is why the product's client emails say as little as they do: a message telling somebody there is a document waiting does not name the document, because a mail provider and a mailbox are two more places it could be read.
Text messages
Twilio, United States. Not currently in use. When it is, it will carry only messages the system has classified as containing no identifying information – a date and a prompt to sign in, never a case, a subject or a location.
Machine assistance
Anthropic, United States. Powers the assistant and the extraction of fields from uploaded documents.
What reaches it is deliberately narrow. Case content does not leave the system without an explicit decision recorded for that capability; identifying values are scrubbed from prompts before they are sent; and every call is recorded with what it was for, what it cost and what came back. Anthropic does not train on data sent through the business API.
Translation
MotaWord, United States. Used only when a firm sends a document out for certified translation, which is a deliberate act on a particular document. Nothing is sent automatically.
What is not on this list
There is no analytics provider, no advertising network, no session recorder, no customer data platform, and no marketing automation tool with access to client data.
Changes
We notify customers before adding to this list or changing what an entry does, so there is time to object. If you want that notice, tell us the address to send it to.
---
*This page describes how the product is built and is written by the people who built it. It has not been reviewed by outside counsel. Ask us for the current list with contract references if you need it for a vendor review.*