Subprocessors
Last updated: August 27, 2026
Lexabrief relies on the following third-party services ("subprocessors") to operate. This page lists each subprocessor, what it is used for, and what data it receives. We update this list when we add or remove a subprocessor.
| Provider | Purpose | Data received |
|---|---|---|
| Google Cloud Platform / Firebase | Hosting, compute, storage, database, and authentication. The primary infrastructure layer for the Service. Includes reCAPTCHA Enterprise for sign-up bot protection. | All account information, case content, files, chat history, and operational logs. Encrypted at rest. |
| Vercel | Frontend hosting and serverless API routing. Some API requests are proxied through Vercel before reaching our backend. | Request metadata (path, headers, IP) and request bodies for API routes that pass through Vercel, including chat content in flight. We do not intentionally log request bodies in our Vercel handlers. |
| OpenRouter (DeepSeek model inference gateway) | Inference gateway for the default DeepSeek model. OpenRouter routes each request to one of a fixed set of US-hosted inference providers (currently Parasail and Atlas Cloud), restricted to providers that operate under no-logging, no-training terms. | Chat messages and document content sent to the model when this route is active. Requests are pinned to US-hosted providers and configured to exclude any provider that retains or trains on prompt data (data-collection denied), so inputs and outputs are processed in memory for the request and not stored or used for training. |
| Anthropic | Large language model inference (Claude family). | Chat messages and document content sent to the model when you use a Claude model. Anthropic's commercial API does not use customer inputs or outputs to train models. |
| Google AI (Gemini API, paid tier) | Large language model inference (Gemini family). Gemini also performs the document and image understanding behind uploads (text extraction from scans, and reading an uploaded image), which runs for every account regardless of the chat model you select. | Chat messages and document content sent to the model when you use a Gemini model, plus the contents of files you upload when they are processed or viewed. The paid Gemini Developer API does not use customer inputs or outputs to train models. |
| OpenAI | Large language model inference (GPT family). | Chat messages and document content sent to the model when you use an OpenAI model. OpenAI's API does not use customer inputs or outputs to train models. |
| LangSmith | Agent execution telemetry. We use this to monitor agent reliability and debug issues. | Trace structure of agent execution: node graph, tool names invoked, latency, token counts, and error states. User inputs and model outputs are masked in production traces and are not transmitted. |
| Cohere | Reranking model used to improve search and retrieval relevance. | Search queries and document snippets passed to the reranker at the time of a request. |
| Stripe | Payment processing and subscription billing. | Billing-related data only: name, email, payment method, transaction events. No case content. |
| PostHog | Product analytics. | Product analytics events and persistent identifiers (for example Firebase UID / PostHog distinct ID). For signed-in users, analytics traits may include email and display name. We do not send case content or chat message text in event payloads. |
| Serper | Web search, used by the agent when a request requires up-to-date information from the public web. | Search queries generated by the agent. These may incorporate context from your request. |
| Free Law Project (CourtListener) | Live legal-record lookup, used by the agent only where our own case-law data cannot answer: an opinion newer than our data, an opinion we do not hold, or a federal court docket or filing record. | Search terms generated by the agent (case names, citations, docket numbers, legal terminology). These may incorporate context from your request. We do not send case content, document text, or draft text. |
| Jina AI | Web content extraction, used to fetch and parse public web pages cited by the agent. | URLs to fetch. Generally these are public web addresses without user PII. |
Notes
- The default DeepSeek model is currently served through OpenRouter by US-hosted Atlas Cloud or Parasail. The other AI inference providers (Anthropic, Google AI, OpenAI) are used on commercial API tiers that, by default, do not use customer inputs or outputs to train their models. We do not opt in to any training or data-sharing program.
- LangSmith production traces are configured to mask user inputs and model outputs. Only execution structure is sent.
- Optional providers (Cohere, Serper, Jina) are used only when the relevant feature is invoked.