Subprocessors ============= Last updated: 2026-08-05 Legal Subprocessors ------------- Last updated: August 5, 2026 · Effective: August 5, 2026 Owndevice, Inc. ("Grounds") uses a small set of infrastructure providers ("Subprocessors") to operate the Grounds service. This page lists each Subprocessor, what they do, where they process data, what categories of data they touch, and whether the customer can opt out. This page is the maintained list of Subprocessors. A Data Processing Agreement is available upon request — contact legal@grounds.ai. We will provide at least 30 days' advance notice of any new Subprocessor; customers may subscribe to notifications as described below. Current Subprocessors Subprocessor · Purpose · Data categories · Region · Customer opt-out · Terms Amazon Web Services, Inc. (Bedrock) · AI inference (zero-retention, no-training) · Customer Personal Data (prompts and outputs) · U.S. East · No — core to Service · aws.amazon.com/service-terms Anthropic (Claude models) · AI inference — primary model family, served entirely through AWS Bedrock in U.S. regions; prompts and outputs are not shared with Anthropic the company and are not used for training (zero retention) · Customer Personal Data (prompts and outputs, within AWS Bedrock only) · U.S. · No — core to Service · aws.amazon.com/service-terms Moonshot AI (Kimi models) · AI inference — cost-efficient background tasks, served entirely through AWS Bedrock; data never reaches Moonshot AI the company. Claude-only processing is available on request · Customer Personal Data (prompts and outputs, within AWS Bedrock only) · U.S. · Yes — request Claude-only processing · aws.amazon.com/service-terms Tavily, Inc. · Web search for AI research features — receives the search query only, and only when web search is used; never receives documents · Search queries (guarded against inclusion of document text) · U.S. · Yes — by not using web search · tavily.com/privacy Free Law Project (CourtListener) · Public case-law lookups via our research service — receives search queries and citations only, never client documents · Case-law search queries and citations only · U.S. · Yes — by not using case-law research · free.law/terms Amazon Web Services, Inc. (SES) · Transactional and notification email · Recipient name, email address, message body · U.S. East · No — core to Service · aws.amazon.com/service-terms Supabase, Inc. · Managed Postgres hosting (primary data store) · Customer Personal Data (documents, embeddings, account data) · U.S. East · No — core to Service · supabase.com/legal/dpa Fly.io, Inc. · Application and API hosting · Customer Personal Data (in-transit, ephemeral) · U.S. multiple · No — core to Service · fly.io/legal/dpa Vercel, Inc. · Marketing site and static asset hosting · Operational telemetry only (no Customer Personal Data) · Global edge · No — marketing site only · vercel.com/legal/dpa Cloudflare, Inc. · DNS, CDN, WAF, and access logs · Request metadata (IP, user-agent); not request bodies for application API · Global edge · No — core to Service · cloudflare.com/cloudflare-customer-dpa Clerk, Inc. · Identity, authentication, and organization management · Account data (name, email, org membership, MFA factors) · U.S. · No — core to Service · clerk.com/legal/dpa Stripe, Inc. · Payment processing and subscription billing · Billing contact, payment-method metadata (no raw card numbers) · U.S. · Only by not subscribing to a paid plan · stripe.com/legal/dpa Categories explained • Customer Personal Data — the documents, redlines, prompts, AI outputs, and account information you submit to the Service, including personal data of third parties that appears in uploaded documents. The canonical definition is in our Data Processing Addendum (available on request). • Operational telemetry only — non-content signals such as request volume, latency, and error rates. These do not include the substance of your documents or prompts. How to subscribe to updates Email subprocessors@grounds.ai from a domain associated with your account, with the subject line "Subscribe". You will receive advance notice of any addition, removal, or material change to this list at least 30 days before the change takes effect. Customers may object to a new Subprocessor on reasonable grounds as described in the DPA. International transfers Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to the United States or other jurisdictions, the transfer mechanisms in Section 6 of our Data Processing Addendum (available on request) apply (EU Standard Contractual Clauses and the UK International Data Transfer Addendum). Contact Questions or objections? subprocessors@grounds.ai.