Subprocessors
The vendors that may process customer data on behalf of Scrivica.
Draft, pending counsel review
This page describes what Scrivica does today. It has not been reviewed by counsel and is not a contract term.
Vercel
- Purpose
- Hosting and serverless compute for the Scrivica web application.
- Data
- All requests to the application, including document text and uploaded sources in transit and in memory while a request runs.
- Region
- To be confirmed
Supabase
- Purpose
- Database, authentication and file storage.
- Data
- Account email and name, organization and study records, source files, documents, comments, audit trail, and encrypted organization API keys.
- Region
- To be confirmed
Anthropic
- Purpose
- AI drafting, checking, text extraction from scanned pages and redaction suggestions.
- Data
- Text from sources, tables and documents that a user sends to an AI feature, and PDF pages sent for text extraction. An organization may use its own Anthropic key.
- Region
- To be confirmed
- Retention
- Zero data retention is not in place. Anthropic's standard API retention applies. An organization that uses its own Anthropic key is covered by its own Anthropic account terms.
Resend (Active only when email is configured)
- Purpose
- Transactional email: invitations, mentions, review rounds and sign-off requests.
- Data
- Recipient email address, names, organization name, role, document title, section number, review round and due date, sign-off step and a link. No document or comment text.
- Region
- To be confirmed
Sentry (Active only when error monitoring is configured)
- Purpose
- Error monitoring.
- Data
- Exception type, scrubbed message, stack frames, release and route. Events are scrubbed of document text, numbers, emails, ids and quoted text before they leave Scrivica. No user, cookie, header, request body or AI prompt data is collected.
- Region
- To be confirmed
Stripe (When billing goes live)
- Purpose
- Invoicing and payments.
- Data
- Billing contact and organization name, plan and invoice details. Not used today.
- Region
- To be confirmed
Cloudflare Turnstile may load on the sign-in page when bot protection is switched on. It receives the visitor's IP address and browser signals needed for the challenge. It never receives document data.