Subprocessors
Version 1.1 · Last revised: October 30, 2026
This is the current published list of subprocessors LegalTime, Inc. engages to process customer personal data for LegalTime AI. Practice-management systems a customer connects (for example Clio Manage or Harvest), and any email or calendar account a customer connects, are that customer's destinations, not LegalTime subprocessors.
The Data Processing Agreement promises at least fifteen days' written notice before we add or replace a subprocessor. This page is the public list. Its git history is the changelog. Objections go to team@legaltime.ai. After the SOC 2 examination, the same list will also appear on LegalTime's Chiaro verified trust page.
1.Current subprocessors
Amazon Web Services, Inc. (Amazon Bedrock) — United States. Large language model inference for classifying attorney activity and generating structured time entries, including inference over screen images. Customer data is transmitted only through LegalTime's authenticated gateway. The Bedrock account is configured with data retention set to none in every region LegalTime uses: prompts, inputs, and outputs are processed in memory, are not stored or logged by the service, and are not used to train any model. Bedrock is the only provider used to generate time entries; there is no failover provider.
Amazon Web Services, Inc. (cloud infrastructure) — United States. Cloud infrastructure for LegalTime's own storage, internal tooling, and logs, separate from the Bedrock inference above.
Supabase, Inc. — United States, on Amazon Web Services infrastructure. Account authentication; storage of account and firm metadata, billing metadata, encrypted credentials for the practice-management connections a customer authorizes, and draft time entries held in LegalTime Cloud. Supabase does not store screen content, screen images, or derived activity context.
Vercel, Inc. — United States. Hosting for LegalTime's account portal, the LegalTime Cloud review interface, and the authenticated inference gateway. Customer data transits Vercel and is not persistently stored there.
Upstash, Inc. — United States. Rate limiting for the account portal. Upstash receives user identifiers and IP addresses used as rate-limiting keys only.
Sentry (Functional Software, Inc.) — United States. Application crash and error telemetry. Sentry does not receive screen content, screen images, document contents, client or matter names, file paths, URLs, model prompts or outputs, or derived activity context.
Stripe, Inc. — United States. Subscription billing and payment processing. Stripe receives billing contact and subscription information. Payment card data is handled only by Stripe and is not stored by LegalTime. Stripe does not receive screen content, derived activity context, or draft time entries.
Resend (Plus Five Five, Inc.) — United States. Delivery of transactional email such as account invitations, password resets, and copies of signed agreements. Resend receives recipient names and email addresses and the content of those emails.
Google LLC (Google Workspace) — United States. LegalTime's company and customer support email. Google receives the content of correspondence with LegalTime, including support requests, in-app feedback, and any attachments a customer chooses to send.
Anthropic, PBC — United States. AI assistant used by LegalTime's own engineering and support staff, which may process limited customer data — for example account and firm metadata or a draft time entry — when LegalTime staff diagnose an issue with the Service. Anthropic is contractually barred from using that data to train its models, and the account is covered by an executed Business Associate Addendum. Unlike the Bedrock inference route, this route is not zero retention: Anthropic retains prompts and outputs for its standard period under its commercial terms. Anthropic is not used to generate customer time entries.
2.Changes and notice
October 30, 2026. This list was corrected to match the providers LegalTime actually uses. xAI (AIQ Phase LLC) and OpenAI OpCo, LLC were removed: they were listed as a text-only failover for Bedrock, that failover was removed from the product on October 29, 2026, and their credentials were revoked. Amazon Web Services cloud infrastructure, Upstash, Stripe, Resend, Google Workspace, and Anthropic were added. Those six were already in use when the earlier version of this page was published and were omitted from it; publishing them is a correction to the disclosure, not a new engagement. No new subprocessor has begun processing customer data as a result of this change.
When a change is planned, LegalTime will update this page and email the notice to the customer admin address at least fifteen days in advance, as the Data Processing Agreement requires. Customers may object in writing on reasonable data-protection grounds within fifteen days of that notice.
3.Contact
Questions or objections: team@legaltime.ai.