Sub-processors
Last updated: September 7, 2026
A law firm cannot delegate its own duty of confidentiality, so it has to know who else can touch what its clients tell it. This is the complete list of third parties that process Customer Data on our behalf. We publish it rather than provide it on request, and we do not add to it quietly.
Everything below is inside our own AWS account
With one exception (Stripe, which handles payments and never receives your documents), every sub-processor here is an Amazon Web Services product operating in our AWS account in the United States. Your documents are not sent to a third-party AI vendor, and no model provider outside AWS receives them.Current sub-processors
| Sub-processor | Purpose | Data it can touch | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, storage, database, authentication and compute | All Customer Data, at rest and in transit | United States (us-east-1) |
| Amazon Bedrock (an AWS service) | The AI models used for matter analysis | Passages retrieved from a matter, and the analysis produced from them | United States |
| Amazon Textract (an AWS service) | Optical character recognition for scanned documents | Page images of scanned documents you upload | United States |
| Amazon Cognito (an AWS service) | Identity and authentication | Name, email address and authentication credentials | United States |
| Stripe, Inc. | Payment processing | Payment details, which are collected by Stripe and never reach our servers | United States |
Model training
Content sent to Amazon Bedrock is processed within our AWS account. AWS does not use it to train models, does not share it with third-party model providers, and does not retain it after the request completes. We do not train any model on your data, and we have no arrangement under which anyone else may.
Changes to this list
We will update this page before a new sub-processor begins processing Customer Data, and firms with an active account will be notified by email at least 30 days in advance. If you object to a new sub-processor on reasonable data-protection grounds, tell us — you may terminate for that reason and export your matter data before the change takes effect.
What is NOT here
- No analytics or advertising vendors. The site carries no third-party tracking.
- No offshore support. Nobody outside the United States accesses production data.
- No data brokers, ever. We do not sell, rent or share Customer Data.
Questions
For a vendor security review or a data-processing agreement, contact us at ap@idtsol.com or +1 954-604-4098. See also our Data Processing Addendum and Privacy Policy.