Subprocessors
ClaireAI uses the providers below for the intake and platform functions indicated. Which providers receive a firm’s information depends on its enabled services and integrations. Website and billing vendors appear separately because their roles differ. The DPA governs authorization, contractual protections, advance notice, and objections to changes in service subprocessors.
Provider register · Version 1 · Last updated: September 4, 2026 · Issued by Claire AI, LLC
This register identifies the current service architecture and available location information. It does not promise that all data remains in one country. Contact ClaireAI for the contracting entity, specific processing countries, support access, retention, and transfer safeguards applicable to your deployment. Where those details are necessary for a lawful restricted transfer, they must be confirmed before that transfer; a vendor’s headquarters or linked general policy is not a deployment-specific assurance.
Service subprocessors
| Provider | Function and data | Processing locations |
|---|---|---|
| Amazon Web Services (AWS) | Backend hosting, object storage, and operational logging Service content, recordings where stored, configuration, and operational logs | United States for the configured backend region; additional storage, backup, and support locations must be confirmed for the service. |
| Cloudflare | Portal hosting, network delivery, and security Requests, network metadata, and application data passing through hosted services | Distributed network. A single-country processing restriction is not represented. |
| Supabase | Application database and authentication Account identities, firm records, transcripts, and related service records | Configured database project is in the United States; backup and support access locations require service-specific confirmation. |
| xAI (Grok API) | Live AI voice interactions and associated transcription Call audio, transcripts, instructions, and necessary intake context | Provider processing and support locations require confirmation for the contracted API service; no regional residency commitment is represented here. |
| Microsoft (Azure AI services) | Post-call model inference and analysis Transcripts, instructions, and customer-specific output | Deployment geography and model processing mode must be confirmed for the service; an endpoint name alone does not establish residency. |
| Telnyx | Telephone numbers, SIP routing, call handling, and carrier media Phone numbers, call audio, carrier metadata, and configured greeting media | Depends on the communications service, routing, and customer elections; see provider information and request the applicable scope. |
| Infobip | SMS delivery where enabled Recipient numbers, message content, delivery status, and related messaging metadata | Depends on the contracted messaging service and carrier routes; provider subprocessor locations are published at the linked page. |
| Resend (Plus Five Five, Inc.) | Transactional email, including firm call notifications Recipient addresses, email content, delivery events, and necessary intake summaries | Service and downstream-provider locations must be confirmed for the account; see provider disclosures. |
Website and business providers
The public website uses Cloudflare for hosting and security and Cloudinary for public media delivery. Visitors may provide contact information through Formspree and schedule demonstrations through Cal.com. Google Analytics and Microsoft Clarity receive optional website analytics only when allowed by the website’s consent controls; GPC disables those optional collectors. These functions do not authorize disclosure of firm intake content to marketing tools.
Stripe provides hosted checkout, payments, subscriptions, and invoices. It receives payment and billing information and may act in its own legal capacity for payment, fraud-prevention, or regulatory purposes. It is not a voice or transcript processor. The Privacy Policy explains these business-data uses and available choices.
Firm-connected systems and other configurations
CRM, practice-management, calendar, and document systems independently selected and contracted by a firm receive information under that firm’s instructions and provider relationship. Examples include Clio and Microsoft Outlook where enabled. They are not automatically ClaireAI subprocessors merely because an integration is available. If ClaireAI engages a provider to process Customer Personal Data on its behalf, the DPA’s subprocessor requirements apply.
Changes and questions
Under the DPA, ClaireAI gives account notice contacts at least 30 days’ advance notice of an intended new or replacement subprocessor, including function and location details. Customers may object on reasonable documented data-protection grounds within that period. Keep your account notice contact current; email us to update it or ask about the register. The DPA describes resolution and termination rights.
Claire AI, LLC · Attn: Privacy Officer4410 NW 5th Ave
Boca Raton, FL 33431, United States
info@theclaireai.com
+1 (954) 997-0065