Subprocessor List

Adjudica.AI — Glass Box Solutions, Inc.

Last Updated: May 4, 2026 Current Version: 1.1

Overview

This page lists the third-party subprocessors that Glass Box Solutions, Inc. ("Provider") engages to process Customer data in connection with the Adjudica.AI platform. This list is maintained pursuant to our Data Processing Agreement and Business Associate Agreements (BAAs).

A "subprocessor" means any third party engaged by Glass Box Solutions that processes Customer data — including Protected Health Information ("PHI") — in connection with delivering the Service.

To receive notifications of subprocessor changes: Email privacy@adjudica.ai with subject "Subprocessor Updates Subscribe".

Current Subprocessors

Infrastructure & Hosting

Contact: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 Privacy Policy: https://cloud.google.com/terms/cloud-privacy-notice Compliance: https://cloud.google.com/security/compliance

Database

Contact: PlanetScale, Inc., 8605 Santa Monica Blvd #99340, West Hollywood, CA 90069 Privacy Policy: https://planetscale.com/legal/privacy Trust: https://planetscale.com/security

Note: PlanetScale PostgreSQL is hosted in AWS us-west-2 (Oregon). Glass Box Solutions has executed a Business Associate Agreement with PlanetScale; AWS, as PlanetScale's underlying infrastructure provider, also operates under HIPAA-eligible services.

AI & Machine Learning

AI Provider Restrictions (contractual):

• No use of Customer data for foundation-model training
• No retention beyond request processing (Zero Data Retention where supported)
• No sharing with third parties

Workflow Orchestration

Contact: Temporal Technologies, Inc., San Francisco, CA Trust: https://temporal.io/security

Document Conversion

Gotenberg is open-source software self-hosted by Glass Box Solutions on Cloud Run. It is included here in the interest of transparency as a discrete data-processing component.

Email & Notifications

Resend is used only for transactional account email. Adjudica does not send PHI by email.

Error Tracking & Performance

Implementation: see app/lib/sentry-pii.ts and server/lib/sentry-request-scope.ts in the Adjudica codebase for the redaction implementation.

LLM Observability

Note: Langfuse traces may contain PHI for the purpose of reviewing model behavior. Glass Box has executed a HIPAA BAA with Langfuse; Customer PHI in traces is handled under that BAA.

Payment Processing

Authentication

BetterAuth is open-source authentication software run by Glass Box. Authentication data lives in PlanetScale under the existing BAA.

Customer-Authorized Integrations (Not Subprocessors)

The following third parties are not Glass Box subprocessors. They are services that the Customer law firm independently maintains a direct relationship with, and which the Customer authorizes Adjudica to access via OAuth on the firm's behalf. PHI flows directly between the Customer and the integration; Glass Box accesses the data only as the Customer's agent.

If you are a Customer evaluating this integration, please confirm that your MerusCase agreement permits API access by approved third-party tools, and that PHI access via OAuth is authorized under your internal HIPAA policies.

AI Training Restrictions

All AI subprocessors that may process Customer data — Google (Vertex AI / Gemini / Document AI), Anthropic, OpenAI — are contractually prohibited from:

• Using Customer data to train, fine-tune, or improve foundation models
• Retaining Customer data beyond what is required to process the request
• Sharing Customer data with third parties

This is enforced through executed BAAs and, where applicable, Zero Data Retention (ZDR) addenda or enterprise-tier terms.

Subprocessor Data Handling Summary

PHI Access Matrix

Data Flow & Processing Activities

High-Level Data Flow

User Upload
   → Google Cloud Storage (object store)
   → Google Document AI (OCR)
   → PlanetScale PostgreSQL (structured data + pgvector embeddings)
   → AI Processing (Vertex AI / Gemini, with selective use of Anthropic, OpenAI)
   → Analysis Results → User Interface (React Router 7, served by Cloud Run)

Workflow orchestration:
   Temporal Cloud (workflow IDs + metadata only — no document content in payloads)

Customer-authorized integration:
   MerusCase API → Adjudica (inbound document import via OAuth, on Customer behalf)

Observability:
   LLM calls → Langfuse (traces, may include PHI under BAA)
   Errors    → Sentry (PHI redacted at SDK boundary)
   Logs      → Google Cloud Operations (PHI scrubbed by Pino redact rules)

Processing Activity by Subprocessor

Geographic Boundaries: All Customer data processing occurs within United States data centers. No cross-border transfers.

Regional Data Storage

Primary Region

• Application + Storage: Google Cloud us-west1 (Oregon)
• Database: PlanetScale PostgreSQL — AWS us-west-2 (Oregon)
• AI processing endpoints: Google Cloud us-west1 and us-central1

Disaster Recovery

• Database backups retained per PlanetScale's continuous backup; encrypted in PlanetScale-managed AWS infrastructure
• Object storage versioning + cross-region replication within United States only

Note: Glass Box does not store or process Customer data outside the United States.

Notification of Changes

Pursuant to our Data Processing Agreement:

• New Subprocessors: Customers will receive at least 30 days' notice before a new subprocessor begins processing Customer data
• Objection Period: Customers may object to a new subprocessor within 15 days of notification
• Updates: This list will be updated when subprocessors are added or removed; the "Last Updated" date and version number above will be incremented

How We Notify

1. Email to registered account owner
2. In-app notification banner
3. Update to this page with highlighted changes

Subscribe to Updates

To receive email notifications of subprocessor changes:

• Email: privacy@adjudica.ai
• Subject: Subprocessor Updates Subscribe
• Include: Company name, contact email

Customer Right to Object

If you object to a new subprocessor:

Step 1: Submit Objection (within 15 days of notification)

• Email: privacy@adjudica.ai
• Subject: Subprocessor Objection - [Subprocessor Name]
• Include: Reason for objection, any alternative solutions you propose

Step 2: Provider Response (within 10 business days)

• We will either:
  • Work with you to address concerns (additional safeguards, contract modification)
  • Provide an alternative technical solution where feasible
  • Discuss transition options if no agreement can be reached

Step 3: Resolution

• If concerns addressed: New subprocessor proceeds with additional safeguards
• If no resolution: You may terminate services per the Data Processing Agreement termination provisions

Valid Objection Grounds

• Security or privacy concerns specific to the subprocessor
• Regulatory compliance conflicts
• Jurisdictional restrictions
• Contractual conflicts with your own obligations

Due Diligence

Before engaging any subprocessor, Glass Box Solutions conducts:

1. Security Assessment — Review of SOC 2 / ISO 27001 reports, security questionnaire, penetration test results where available
2. Privacy Assessment — Data handling practices review, privacy policy evaluation, CCPA/HIPAA compliance verification
3. Contractual Requirements — Data Processing Agreement, BAA where PHI is processed, confidentiality and audit-rights provisions
4. Ongoing Monitoring — Annual review, certification renewal verification, incident notification monitoring

Regulatory Compliance Mapping

HIPAA — Business Associate Agreements

All subprocessors that process PHI on Glass Box's behalf have an executed Business Associate Agreement on file. Customers may request copies subject to the subprocessor's confidentiality requirements.

CCPA / CPRA — Service Provider Designation

All subprocessors processing Customer personal information are designated as "Service Providers" under California Civil Code §1798.140(ag). Each is bound by:

• ✓ Written contract with enumerated business purposes
• ✓ Prohibition on selling, sharing, or retaining personal information for any purpose other than the contracted service
• ✓ Prohibition on combining data with information from other sources
• ✓ Certification of understanding obligations
• ✓ Right of audit

SOC 2 — Subprocessor Attestations

Glass Box collects and reviews each subprocessor's most recent SOC 2 Type II attestation. Reports are available to Customers under NDA upon request to compliance@adjudica.ai.

Incident Response & Breach Notification

Subprocessor Obligations

All PHI-processing subprocessors are contractually required to:

1. Notify Glass Box Solutions within 24–48 hours of becoming aware of any security incident
2. Provide incident details (nature, data affected, mitigation steps)
3. Cooperate with investigation (forensics, root cause, remediation)
4. Implement corrective measures

Glass Box Response

Upon subprocessor breach notification:

Within 24 hours: Customer-data impact assessment; internal investigation begins; containment measures implemented Within 72 hours: Notify affected Customers per BAA / DPA terms; provide summary and impact assessment Ongoing: Root-cause analysis, additional safeguards, regular Customer updates, re-evaluation of subprocessor relationship if warranted

Audit Rights

Customer Audit Rights

Pursuant to the Data Processing Agreement and BAAs:

Customers may:

• Request subprocessor security certifications (SOC 2, ISO 27001)
• Request subprocessor BAA confirmations
• Conduct annual audit of Glass Box's subprocessor management program
• Request evidence of subprocessor due diligence

Limitations:

• Direct audits of subprocessors require subprocessor consent
• NDA required for confidential information
• Audit frequency limited per DPA (typically annual)

How to request: Email compliance@adjudica.ai with subject "Subprocessor Audit Request"

Subprocessor Change History

Questions

• Privacy Team: privacy@adjudica.ai
• Security Team: security@adjudica.ai
• Compliance: compliance@adjudica.ai
• DPA / BAA Questions: legal@glassboxsolutions.com

Support hours: Monday–Friday, 9am–5pm Pacific Time Emergency security contact: security@adjudica.ai (24/7 monitored)

Glass Box Solutions, Inc.

@Developed & Documented by Glass Box Solutions, Inc. using human ingenuity and modern technology