Legal
Subprocessors
Last updated: May 15, 2026
1. Overview
This page lists the third-party subprocessors and vendors that ModulawAI engages to deliver the Platform. It is the authoritative source — the lists embedded in our other policy documents (Privacy Policy, Data Protection Policy, Data Processing Agreement) point here.
Each subprocessor is bound by a written agreement containing confidentiality, security, and (where applicable) data-protection obligations equivalent to those in our DPA. Where a vendor offers a no-training assurance for AI inputs, we rely on that contractual commitment.
2. Notification of changes
We notify enterprise customers at least 30 days before adding a new subprocessor that processes Personal Data on our behalf, in line with our Data Processing Agreement, §6. Customers may object within that window by emailing dpo@modulaw.ai; if we cannot reasonably accommodate the objection, the affected services may be terminated without penalty.
Objections and policy correspondence are reviewed by our Chief Legal Officer (see our Data Protection Policy, §17), independent of engineering and product operations.
To receive change notifications, subscribe by emailing dpo@modulaw.ai with the subject line “Subprocessor updates”.
3. Infrastructure & storage
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Primary cloud hosting (App Service, Static Web Apps, Blob Storage) | US East 2 / EU |
| AWS | Bedrock AI inference; Amplify hosting for the ModulawAI for Word add-in | US / EU regions |
| MongoDB Atlas | Primary application database | US / Azure regions |
| Neo4j | Graph database for case-law relationships | US / EU |
| Redis | Session caching and rate-limiting | Azure region |
| Pinecone | Vector database for AI embeddings | US |
| Azure Document Intelligence | OCR and form parsing on uploaded documents | US / EU |
4. AI / inference
| Provider | Purpose | Location |
|---|---|---|
| Azure OpenAI Service | Chat completions and text embeddings | US / EU |
| AWS Bedrock | Hosted foundation models (Anthropic Claude, Amazon Nova, Meta Llama, Moonshot Kimi) | US / EU regions |
| Fireworks AI | Open-weight reasoning models | US |
| Anthropic | Direct API access for some ModulawAI for Word features | US |
| LangSmith (LangChain) | Optional LLM-call tracing; only active when enabled by configuration | US |
Each AI provider receives the prompt and contextual snippets necessary to answer a request. All receive API inputs under no-training assurances. User content is not used to train base models.
5. Voice & real-time
| Provider | Purpose | Location |
|---|---|---|
| LiveKit | Real-time voice/video infrastructure for AI voice agent and call features | US / EU / global edge |
| Deepgram | Speech-to-text transcription of call recordings | US |
| ElevenLabs | Text-to-speech voice synthesis for AI responses | US |
| Cartesia | Text-to-speech fallback provider | US |
6. Messaging, payments, security
| Provider | Purpose | Location |
|---|---|---|
| Paystack | Payment processing (NGN subscriptions, invoices, seat purchases) | Nigeria / US |
| Stripe | Payment processing (non-NGN subscriptions) | United States / EU |
| ZeptoMail (Zoho) | Transactional email delivery | India / US |
| WhatsApp Business / Meta | OTP and booking notifications on user opt-in | US / Ireland |
| Google reCAPTCHA | Bot protection on public forms | US |
7. Research & legal data
| Provider | Purpose | Location |
|---|---|---|
| CourtListener | US case law lookup and citation verification | US |
| CanLII | Canadian case law lookup | Canada |
| EUR-Lex | EU legislation lookup | EU |
| TinyFish | Browser-based citation verification for jurisdictions without an official API (UK, Ghana, Kenya, South Africa) | US |
| Tavily | Web search augmentation for research queries | US |
| Bing Search API (Microsoft) | Web search augmentation | US / EU |
| Google Custom Search | Web search augmentation | US |
8. Analytics & marketing
All entries here are consent-gated. Optional cookies are off by default; see our Cookie Policy for the list of cookies set by each provider.
| Provider | Purpose | Location |
|---|---|---|
| Google Analytics (GA4) | Website analytics (anonymized) | US |
| Microsoft Clarity | Behavioral analytics (masked) | US |
| Meta (Facebook Pixel) | Marketing attribution | US |
| TikTok Pixel | Marketing attribution | US |
| X / Twitter Ads | Marketing attribution | US |
| Apollo | Marketing attribution | US |
9. User-authorised integrations
These are not subprocessors in the traditional sense. Users (or workspace administrators) choose to connect their own accounts and we act on their authorised instructions. Data flows to and from these systems are governed by the third party’s own terms.
| Provider | Purpose |
|---|---|
| Google Workspace (Gmail, Calendar, Drive) | Email, calendar, document access on user authorisation |
| Microsoft 365 (Outlook, OneDrive, Teams Calendar, Word add-in) | Email, calendar, document access on user authorisation |
| Zoho (CRM, Mail, Bookings) | CRM / email / scheduling sync on user authorisation |
10. Changelog
Most recent changes first. Older changes archived after 24 months.
June 12, 2026
- Added: Stripe (payment processing for non-NGN subscriptions in regions outside Nigeria). Paystack continues to process NGN payments.
May 15, 2026
- Added: Fireworks AI (open-weight reasoning model inference).
- Added: AWS — formalised as a category for AWS Bedrock inference and AWS Amplify hosting of the ModulawAI for Word add-in.
- Added (newly disclosed): LiveKit, Deepgram, ElevenLabs, Cartesia (voice stack); ZeptoMail (transactional email); WhatsApp Business (OTP); Google reCAPTCHA; Tavily, Bing Search, Google Custom Search; CourtListener, CanLII, EUR-Lex; Neo4j, Redis, Azure Document Intelligence; LangSmith (optional). These vendors were previously in use but not all named in policy text; this update brings the disclosure list in line with what’s actually deployed.
- Disclosure expanded: AI provider list now explicitly names Anthropic, AWS Bedrock, Azure OpenAI, and Fireworks AI in Privacy Policy and Data Protection Policy (previously inconsistent across documents).
March 22, 2026
- Data Protection Policy first published with subprocessor table listing MongoDB Atlas, Microsoft Azure, Azure OpenAI Service, Pinecone, Paystack, Google Analytics, Microsoft Clarity, Meta, TikTok.
11. Contact
Questions about subprocessors, notification subscriptions, or objections to a planned change: dpo@modulaw.ai.