1. Purpose
This Public Subprocessor List identifies the third-party service providers Clasp uses to operate the Service. These subprocessors support hosting, database, authentication, messaging, billing and payments, OCR, document editing, error monitoring, and limited AI functionality. This list is provided for transparency and does not create contractual rights or obligations.
Contractual terms governing subprocessors are defined in Appendix H of the Clasp Master Services Agreement (MSA).
2. How Clasp Uses Subprocessors
Clasp uses subprocessors to:
- host and secure the platform;
- store application data;
- authenticate Users;
- process notifications, messages, and email delivery;
- process payments;
- perform OCR for search indexing;
- support browser-based document editing;
- monitor errors and receive bug reports;
- generate draft time-capture descriptions (optional); and
- maintain system performance and reliability.
Clasp does not transmit document text to external large language models. Clasp does not use subprocessors for marketing or advertising.
3. Current Subprocessors
| Subprocessor | Function | Data processed | Location |
| Google Cloud Platform (GCP) | Hosting, document and file storage, encryption, load balancing, networking | Customer Data, Account Data, Usage Data, OCR outputs, embeddings, metadata | United States |
| Supabase | Application database; authentication for “Sign in with Google” and OTP generation | Account Data, application data, embeddings, authentication metadata | United States |
| Unstructured.io | OCR and document parsing for search indexing | Document text for OCR extraction only | United States |
| Postmark | Transactional email delivery | Email metadata, notification content | United States |
| Twilio | Programmable SMS messaging | Phone number metadata, message content | United States |
| GetStream | In-application and client portal messaging | Messages and content Users choose to send | Provider-determined |
| Firebase (Google) | In-application and push notifications | Notification content, device identifiers | Provider-determined |
| Confido | Payment processing for payments Customers accept from their clients (where enabled); collection of Clasp’s payment fees | Payment information, payment metadata | United States |
| Microsoft (Word for the web) | Browser-based document editing, when a User opens a document for editing | Document content during editing | Provider-determined |
| Sentry | Application error monitoring | Technical error and device data | Provider-determined |
| Shake | In-application bug reporting | Information a User submits in a bug report | Provider-determined |
| Vercel | Hosting of front-end application code | Technical request metadata | Provider-determined |
| OpenAI (optional) | Draft time-capture descriptions, only when Customer enables Time Capture AI processing | System-generated internal metadata only; no document text | United States |
Notes:
- Supabase does not access document files. Twilio does not access document content.
- Clasp does not store payment card data (PCI).
- Sentry and Shake are used only to detect and fix errors and improve the user experience, not for analytics or advertising.
- Under OpenAI’s published API terms, data submitted through the API is not used to train OpenAI’s models.
- Services that Customers or Users choose to connect (such as Google Drive imports, QuickBooks Online, Connectors and the AI services connected through them, or a migration provider) are Third-Party Services, not subprocessors.
4. Subprocessor Changes
Clasp may add, replace, or remove subprocessors at any time. Changes to this public list do not amend the MSA. Contractual notice and objection terms, if applicable, are defined in Section 5.12 of the MSA and Appendix H.
5. Questions
For questions about subprocessors, contact Clasp Legal Technologies, Inc. at hello@clasplegal.com.