Sub-processors

The third-party services Contract Flash uses to process customer data, what each one does, where it runs, and what data it touches. This list is linked from the Privacy Policy, the Security page, and the Data Processing Agreement.

AI providers: OpenAI handles AI processing, embeddings, and agent capabilities in the United States; contract text sent for analysis is not used for training and is retained up to 30 days for abuse monitoring. Anthropic handles contract extraction and analysis in the United States, and does not use API data for training. Google Cloud Document AI performs OCR on scanned PDFs.

Infrastructure: Neon hosts the database (United States / EU regions) holding structured contract data, user accounts, and audit logs, encrypted at rest. Cloudflare R2 stores uploaded contract files at the global Cloudflare edge, encrypted at rest. Cloudflare provides CDN and DNS and caches no contract content. Hetzner hosts the application in Germany.

Business services: Stripe processes payments and subscription billing — card data never touches Contract Flash servers. Resend delivers transactional email. Microsoft Graph performs document conversion. Sentry receives error tracking data.

Questions about this list can be sent to [email protected].