Subprocessors
Last updated: 2026-05-05 · Version v2-2026-05-05
Effective Date: 2026-05-05 · Last Updated: 2026-05-05 · Version: v2-2026-05-05
This page lists the third-party service providers ("subprocessors") that Surface Owl Inc. ("we," "us," "our") engages to help operate Clarifidata.app (the "Service"). Each subprocessor is bound by a written agreement that requires it to protect personal information and to use it only for the purposes we direct, consistent with the commitments in our Privacy Policy §4.1.
Change-notice commitment
We will provide at least thirty (30) calendar days' notice of any new subprocessor that materially affects the processing of your personal information by:
- Posting an updated version of this page with a new "Last Updated" date; and
- Sending email notice to paid-tier customers.
You may object to a new subprocessor by emailing our support address (listed in the Privacy Policy §14 contact section) within that 30-day window. If we cannot reasonably accommodate your objection, your sole remedy is to cancel the affected subscription with a prorated refund of the unused portion of the current term, per Privacy Policy §4.1 and Terms §5.2.
What appears on this page (publication policy)
This page lists only currently-integrated, contractually-bound subprocessors at the time of publication. Specifically, every entry below reflects a vendor that:
- Is wired into the Service today (or is configured and ready to receive production traffic), and
- Has an executed Data Processing Addendum (DPA) or has accepted standard customer terms that include data-protection provisions, and
- Has been disclosed in this list before the first transmission of personal information to that vendor.
We deliberately do not list vendors that are merely "under evaluation," "planned," or "TBD" — listing speculative vendors we have not contracted with would be misleading to readers relying on this page for their own compliance review. New subprocessors are added via the 30-day change-notice mechanism described above; that mechanism is the supported way to evolve this list.
Editor's note (draft phase): While this document remains in draft, some rows may still carry "Planned — not yet live" or "Under evaluation" status to preserve context during counsel review. Before publication of the counsel-reviewed v1, all such rows must either be (a) promoted to In production with a confirmed DPA, or (b) removed from the page and re-introduced later via the change-notice process.
Current subprocessors
The table below distinguishes between subprocessors in production today and those that are configured but not yet live or planned. Status reflects the actual deployment state at the "Last Updated" date above.
| Subprocessor | Function | Data shared | Processing location | DPA status | Status |
|---|---|---|---|---|---|
| Anthropic, PBC | Large-language-model API (Claude) for the Chat feature and AI-assisted data extraction from scanned filings | Chat query text; image data from public IRS Form 990 PDFs. No account identifiers are sent. | United States | Standard Anthropic Commercial Terms (no training on customer inputs) | In production |
| Auth0 (Okta, Inc.) | Authentication and identity management | Email address, hashed password, authentication metadata | United States | Standard Auth0 / Okta DPA | In production |
| AWS (Amazon Web Services, Inc.) | Object storage (Amazon S3) for archived filings and derived artifacts | Public IRS Form 990 PDF/image artifacts and derived ingestion outputs; potential future use for user-account backups (subject to a privacy-policy update before any user PII is stored). | United States (AWS region to be selected) | AWS Service Terms (incorporating AWS DPA) | Planned — not yet live. S3 integration is in design; this page will be updated before any data is written. |
| Bird / SparkPost (Bird, formerly MessageBird N.V.; SparkPost is Bird's email API product) | Candidate vendor for high-volume transactional and (opt-in) marketing email delivery (renewal reminders, drip campaigns) — distinct from the Google Workspace inbox above | Email address, recipient name, message content | See vendor documentation | Planned — under evaluation. Not yet wired into the Service. Final marketing-email vendor (Bird/SparkPost vs. Squarespace) is TBD; we will update this page before any first send. | |
| Cloudflare, Inc. | Network protection, DDoS mitigation, edge caching | IP address, request metadata | Global edge network | Standard Cloudflare DPA | Planned — not yet live. Fly.io's default edge protection is in use today; Cloudflare will be added before public launch. |
| Fly.io (Fly.io, Inc.) | Application and database hosting (PostgreSQL with pgvector) | All application data (encrypted at rest), including account data, usage logs, and content you submit | United States (Fly.io regions selected per app) | Standard Fly.io DPA | In production |
| Google LLC (Google Workspace) | Business email — operates our support, privacy, and billing inbox and outbound transactional email from Surface Owl Inc. domains | Email message content, sender and recipient addresses, attachments, message metadata | United States | Google Workspace Data Processing Amendment (executed via admin console) | In production |
| Modal Labs, Inc. | Optional cloud GPU compute for batch data processing (alignment, OCR, embedding) | Public IRS Form 990 PDF/image data and derived artifacts. No personal identifiers about Service users are sent. | United States | Standard Modal Labs Terms | In production for opt-in batch jobs (--cloud ingestion flag); not used for end-user requests |
| Squarespace, Inc. | Candidate vendor for opt-in marketing email campaigns (drip campaigns, feature announcements). Note: Squarespace may separately provide DNS hosting for clarifidata.app; that DNS-only role is treated as routing infrastructure (analogous to an ISP) and is not classified as a subprocessor under standard CCPA / GDPR processor analysis. Only the email-campaign role, if adopted, would constitute subprocessing. |
Email address, recipient name, message content (if email-campaign role is adopted) | United States | Squarespace Customer Terms (incorporating Data Processing Addendum) | Planned — under evaluation. Not yet wired into the Service. Final marketing-email vendor (Bird/SparkPost vs. Squarespace) is TBD; we will update this page before any first send. |
| Stripe, Inc. | Payment processing, subscription management, billing portal | Name, email, billing address, payment method (tokenized), subscription status | United States | Standard Stripe DPA | Configured for paid tiers; first paid customers in onboarding |
What "DPA status" means
- Executed: A signed Data Processing Addendum is on file.
- Standard terms: The vendor's published standard customer terms (which include data-protection provisions) govern the engagement, and we have accepted them.
- Pending: The vendor relationship exists but a DPA has not yet been signed.
What is not a subprocessor
The Service consumes data from several public data sources. These are sources we read from; they do not receive personal information about Service users and are therefore not subprocessors.
| Source | Role |
|---|---|
| U.S. Internal Revenue Service | Source of public Form 990 XML and PDF filings (Tax-Exempt Organizations Search bulk archives). We download public filings; nothing is sent to the IRS. |
| ProPublica Nonprofit Explorer | Discovery index used to look up EINs and available tax periods. We use the ProPublica API to discover which filings exist; we do not ingest ProPublica's HTML pages, narrative articles, editorial content, or any ProPublica-authored content as an input to the Service. The actual filings we ingest are IRS-authored documents (PDF and XML) fetched directly from the IRS. We read; we do not send. |
| National Center for Charitable Statistics (NCCS) | Source of harmonized sector benchmark data. Read-only. |
| California Association of Independent Schools (CAIS) and similar accreditation bodies | Public membership directories used to build school-EIN match tables. Read-only. |
These public sources are referenced in our Terms of Service §7 and Privacy Policy §1.1.
Contact
Questions about this list? Use the support address listed in our Privacy Policy §14 with the subject "Subprocessor question."