Sub-processors
Last updated: April 2026
Contract-as-Code uses the following third-party sub-processors to deliver the service. Each sub-processor is listed with its purpose, the categories of data it may access, and the geographic location of processing.
We will notify customers at least 30 days before adding a new sub-processor or materially changing how an existing sub-processor is used. Notifications will be sent by email to the account owner and posted on this page.
Current sub-processors
| Sub-processor | Purpose | Data categories | Processing location |
|---|---|---|---|
| Google Cloud Platform | Infrastructure: Cloud Run (API and web app hosting), Cloud SQL (PostgreSQL database), Cloud Storage (PDF and CSV file storage), Cloud Functions (background processing), Firebase Authentication (identity management), Firebase Hosting (static sites) | Account information, agreement documents, hashed payroll datasets, validation findings, audit logs | Canada (northamerica-northeast1, Montreal) |
| Anthropic | AI rule extraction from collective agreement clause text | Agreement clause text only. No employee data, names, identifiers, or payroll values are sent to Anthropic. | United States |
| Stripe | Payment processing, subscription billing, invoicing | Organization name, billing contact email, payment method details (handled by Stripe — card numbers never touch our servers) | United States |
| Amazon Web Services (SES) | Transactional and notification email delivery | Recipient email addresses, email subject and body content | Canada (ca-central-1) |
Important notes on AI processing
Anthropic (Claude) is used to extract structured rules from collective agreement clause text. Anthropic receives only agreement clause text — never employee data, names, identifiers, or payroll values. Employee identifiers are SHA-256 hashed before any processing step and are never sent to Anthropic.
Anthropic processes data in the United States. All other primary data storage (database, file storage, authentication) is located in Canada (northamerica-northeast1, Montreal).
Questions
For questions about our sub-processors or data processing practices, contact privacy@contract-as-code.com.