Legal
Subprocessors
This is the current subprocessor list referenced by the Data Processing Addendum (Section 6.3) and the Privacy Policy (Section 14.4).
We give thirty (30) days’ advance notice before adding or replacing any subprocessor that processes Customer Personal Data. Notice goes to firm administrators, and a new version of this page is published. If you object to a new subprocessor and we cannot accommodate you, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.
Version 1.1 — September 3, 2026 · Current version at cedent.ai/subprocessors
A. Subprocessors processing Customer Personal Data
| # | Subprocessor | Purpose | Location |
|---|---|---|---|
| 1 | Amazon Web Services, Inc. — ECS, S3, Bedrock, ElastiCache, KMS, Secrets Manager | Hosting, storage, all AI inference, caching, key and secret management | United States |
| 2 | Neon, Inc. | Database hosting | United States |
| 3 | Modal Labs, Inc. | Document text extraction and OCR | United States |
| 4 | Clerk, Inc. | Authentication and identity management | United States |
| 5 | Resend, Inc. | Platform notification email | United States |
| 6 | PostHog, Inc. | Product analytics | United States |
| 7 | Axiom, Inc. | Application and audit log ingestion | United States |
B. Not processing Customer Personal Data
| # | Party | Purpose | Note |
|---|---|---|---|
| 8 | Stripe, Inc. | Payments and subscription management | Independent controller for payment data. Card credentials go directly to Stripe and never reach Cedent’s systems |
| 9 | Netlify, Inc. | Marketing website hosting | cedent.ai marketing site only — no application data |
| 10 | Google LLC — Google Analytics 4 | Marketing website analytics | Marketing site only. Google Signals and Ads linkage disabled |
| 11 | PostHog, Inc. | Marketing website analytics | Marketing site only. No session recording. Already listed at #6 for product analytics — one provider, two separate uses |
C. Approved but not yet in production
Thirty days’ notice will be given before any of these begins processing Customer Personal Data.
| Party | Purpose | Status |
|---|---|---|
| Functional Software, Inc. (Sentry) | Application error monitoring | Not enabled. Pending DSN configuration and executed DPA |
| Clio (Themis Solutions Inc.) | Practice management synchronization | Not launched. Pending partner agreement review |
D. Removed
| Party | Reason | Removed |
|---|---|---|
| Railway Corp. | Used for staging and test environments only, never production. Does not process Customer Personal Data. Listed in error in the July 2026 privacy policy | v1.0 |
| Marker | Self-hosted software, not a third-party service, and used only in staging and development. Production document extraction runs entirely on Modal. Not a subprocessor | v1.0 |
Change log
| Version | Date | Change |
|---|---|---|
| 1.1 | September 3, 2026 | Listed PostHog at #11 for marketing-website analytics. No thirty-day notice was required: PostHog was already an authorized subprocessor at #6, and Section B covers parties that do not process Customer Personal Data, so nothing new began processing it |
| 1.0 | September 1, 2026 | Initial versioned list. Added Stripe and Axiom; removed Railway and Marker; disclosed Sentry and Clio as pending |