Subprocessors
Last updated: May 29, 2026
Lexabrief relies on the following third-party services ("subprocessors") to operate. This page lists each subprocessor, what it is used for, and what data it receives. We update this list when we add or remove a subprocessor.
| Provider | Purpose | Data received |
|---|---|---|
| Google Cloud Platform / Firebase | Hosting, compute, storage, database, and authentication. The primary infrastructure layer for the Service. Includes reCAPTCHA Enterprise for sign-up bot protection. | All account information, case content, files, chat history, and operational logs. Encrypted at rest. |
| Vercel | Frontend hosting and serverless API routing. Some API requests are proxied through Vercel before reaching our backend. | Request metadata (path, headers, IP) and request bodies for API routes that pass through Vercel, including chat content in flight. We do not intentionally log request bodies in our Vercel handlers. |
| OpenRouter (DeepSeek model inference gateway) | Inference gateway for the default DeepSeek open-weight model. OpenRouter routes each request to one of a fixed set of US-hosted inference providers (currently Parasail, GMI Cloud, and Atlas Cloud), restricted to providers that operate under no-logging, no-training terms. | Chat messages and document content sent to the model when you use the DeepSeek model (currently the default model). Requests are pinned to US-hosted providers and configured to exclude any provider that retains or trains on prompt data (data-collection denied), so inputs and outputs are processed in memory for the request and not stored or used for training. |
| Anthropic | Large language model inference (Claude family). | Chat messages and document content sent to the model when you use a Claude model. Anthropic's commercial API does not use customer inputs or outputs to train models. |
| Google AI (Gemini API, paid tier) | Large language model inference (Gemini family). | Chat messages and document content sent to the model when you use a Gemini model. The paid Gemini Developer API does not use customer inputs or outputs to train models. |
| OpenAI | Large language model inference (GPT family). | Chat messages and document content sent to the model when you use an OpenAI model. OpenAI's API does not use customer inputs or outputs to train models. |
| LangSmith | Agent execution telemetry. We use this to monitor agent reliability and debug issues. | Trace structure of agent execution: node graph, tool names invoked, latency, token counts, and error states. User inputs and model outputs are masked in production traces and are not transmitted. |
| Cohere | Reranking model used to improve search and retrieval relevance. | Search queries and document snippets passed to the reranker at the time of a request. |
| Stripe | Payment processing and subscription billing. | Billing-related data only: name, email, payment method, transaction events. No case content. |
| PostHog | Product analytics. | Product analytics events and persistent identifiers (for example Firebase UID / PostHog distinct ID). For signed-in users, analytics traits may include email and display name. We do not send case content or chat message text in event payloads. |
| Serper | Web search, used by the agent when a request requires up-to-date information from the public web. | Search queries generated by the agent. These may incorporate context from your request. |
| Jina AI | Web content extraction, used to fetch and parse public web pages cited by the agent. | URLs to fetch. Generally these are public web addresses without user PII. |
Notes
- The AI inference providers (OpenRouter, Anthropic, Google AI, OpenAI) are used on commercial API tiers that, by default, do not use customer inputs or outputs to train their models. The default DeepSeek model is served through OpenRouter, pinned to US-hosted providers and configured to route only to providers that do not log or train on prompt data. We do not opt in to any training or data-sharing program.
- LangSmith production traces are configured to mask user inputs and model outputs. Only execution structure is sent.
- Optional providers (Cohere, Serper, Jina) are used only when the relevant feature is invoked.