1. Purpose and Scope
This Appendix identifies the subprocessors Clasp uses to provide the Service. Subprocessors perform limited processing activities on Customer Data as necessary for Clasp to operate, maintain, and support the Service. Clasp may update this list from time to time in accordance with Section 5.12 of the Agreement.
2. Current Subprocessors
2.1 Cloud Hosting & Storage
| Subprocessor | Purpose | Location |
| Google Cloud Platform (GCP) | Primary hosting, document and file storage, encryption at rest, infrastructure services | United States |
GCP provides physical, environmental, and infrastructure-level security controls. Region selection is not configurable by Customer.
2.2 Database & Authentication
| Subprocessor | Purpose | Location |
| Supabase | Application database hosting; authentication flow for “Sign in with Google” and OTP generation | United States |
Supabase hosts structured application data, account data, and embeddings. Supabase is not used for document file storage.
2.3 Document Processing (OCR)
| Subprocessor | Purpose | Location |
| Unstructured.io | OCR and text extraction for document indexing and search | United States |
OCR is read-only and does not modify document content.
2.4 Email Delivery
| Subprocessor | Purpose | Location |
| Postmark | Transactional email delivery for notifications, sharing links, OTP emails, and system messages | United States |
Postmark handles all outbound email delivery. Clasp does not guarantee delivery times or deliverability rates.
2.5 Messaging & Notifications
| Subprocessor | Purpose | Location |
| Twilio | Programmable SMS messaging | United States |
| GetStream | In-application and client portal messaging | Provider-determined |
| Firebase (Google) | In-application and push notifications | Provider-determined |
Messaging providers process the messages and content that Customer and its Users choose to send through messaging features. Customer determines what information it shares through those features. Twilio does not access document content.
2.6 Payments
| Subprocessor | Purpose | Location |
| Confido | Payment processing for payments that Customer accepts from its clients, where Customer enables it, and collection of Payment Fees | United States |
Payment Processors process billing and payment information only and do not access Customer Data stored in the Service. Customer’s use of a Payment Processor is also governed by Section 2.10 of the Agreement.
2.7 Document Editing
| Subprocessor | Purpose | Location |
| Microsoft (Word for the web) | Browser-based document editing, when a User opens a document for editing | Provider-determined |
Documents are processed by Microsoft only when a User opens them for editing in Word for the web.
2.8 Error Monitoring & Bug Reporting
| Subprocessor | Purpose | Location |
| Sentry | Application error monitoring | Provider-determined |
| Shake | In-application bug reporting | Provider-determined |
These tools are used solely to detect and fix errors and improve the user experience. They are not used for advertising, behavioral analytics, or cross-site tracking. They may collect technical information such as device, browser, and error details and, for bug reports, information a User chooses to submit, such as a description or screenshot, which may include Customer Data visible on screen.
2.9 Application Delivery
| Subprocessor | Purpose | Location |
| Vercel | Hosting of front-end application code | Provider-determined |
Vercel processes technical request metadata only.
2.10 AI Vendors
Clasp does not use external AI vendors for embeddings or inference in the core Service. All metadata and embeddings used for search, document organization, and workflow features are generated internally.
Clasp uses OpenAI solely for the optional Time Capture module, and only when Customer elects to enable both (a) Time Capture and (b) AI processing for Time Capture. When enabled, OpenAI processes system-generated internal metadata only to generate draft time-capture descriptions. Clasp does not transmit document text to OpenAI.
OpenAI processes submitted metadata solely to provide the requested inference. Under OpenAI’s published API terms, data submitted through the API is not used to train or improve OpenAI’s models and is not used for advertising or marketing purposes. OpenAI’s processing is governed by its published API policies and enterprise data-handling commitments.
This optional use of OpenAI is limited to the Time Capture module and does not affect any other part of the Service.
2.11 Customer-Selected Services
Services that Customer or its Users choose to connect or engage are Third-Party Services, not subprocessors, and are governed by Section 2.6 of the Agreement. Examples include Google, Dropbox, and OneDrive imports; calendar, email, and video-meeting integrations; QuickBooks Online; Connectors and Connected AI Services; and any migration provider Customer engages.
3. Subprocessor Limitations
Subprocessors:
- do not access Customer Data except as required to perform their limited functions;
- do not provide legal advice or legal analysis;
- do not receive Customer Data for training or model development;
- do not receive Customer Data for advertising or marketing;
- do not receive Customer Data beyond what is necessary for their operational role.
4. Updates to Subprocessors
Clasp may add, replace, or remove subprocessors at any time and may update this Appendix accordingly, as provided in Section 5.12 of the Agreement. Clasp will use reasonable efforts to inform Customer of material additions. Customer’s objection rights and sole and exclusive remedy are set out in Section 5.12 of the Agreement.