Subprocessor List

Overview

This page lists the third-party subprocessors that Glass Box Solutions, Inc. ("Provider") engages to process Customer data in connection with the Adjudica.AI platform. This list is maintained pursuant to our Data Processing Agreement and Business Associate Agreements.

To receive notifications of subprocessor changes: Email privacy@adjudica.ai with subject "Subprocessor Updates Subscribe"

Current Subprocessors

Infrastructure & Hosting

Subprocessor	Location	Purpose	Data Processed	Certifications
Google Cloud Platform (GCP)	United States (us-west1, us-central1)	Cloud infrastructure, data storage, computing	All Customer data including PHI	SOC 1/2/3, ISO 27001/17/18, HIPAA BAA, FedRAMP
Google Cloud SQL	United States (us-west1)	Database services	Structured data, case metadata, user data	SOC 2, ISO 27001, HIPAA BAA
Google Cloud Storage	United States (us-west1)	Document and file storage	Uploaded medical records, legal documents, PHI	SOC 2, ISO 27001, HIPAA BAA

Contact: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043

Privacy Policy: https://cloud.google.com/terms/cloud-privacy-notice

Compliance: https://cloud.google.com/security/compliance

AI & Machine Learning

Subprocessor	Location	Purpose	Data Processed	Certifications
Google Gemini / Vertex AI	United States (us-west1)	AI language model for document analysis, legal research, OCR, text extraction	Medical records, legal briefs, user queries, case analysis (no model training)	SOC 2, ISO 27001, HIPAA BAA

Google Contact: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043

Privacy Policy: https://cloud.google.com/terms/cloud-privacy-notice

Data Retention: Prompts and responses not retained beyond request processing (per BAA terms)

Vector Database & Search

Subprocessor	Location	Purpose	Data Processed	Certifications
Pinecone	United States (us-west1-gcp)	Vector database for semantic search and document retrieval	Document embeddings (mathematical representations), metadata	SOC 2 Type II, HIPAA BAA

Contact: Pinecone Systems, Inc., New York, NY

Privacy Policy: https://www.pinecone.io/privacy

Data Type: Embeddings only (not raw PHI text)

Authentication & Identity

Subprocessor	Location	Purpose	Data Processed	Certifications
Google Identity Platform	United States	Authentication, SSO	User credentials, session data	SOC 2, ISO 27001, HIPAA BAA

Email & Communications

Subprocessor	Location	Purpose	Data Processed	Certifications
SendGrid (Twilio)	United States	Transactional email delivery	Email addresses, notification content	SOC 2 Type II, ISO 27001

Payment Processing

Subprocessor	Location	Purpose	Data Processed	Certifications
Stripe	United States	Payment processing, billing	Payment information, billing details (no PHI)	PCI DSS Level 1, SOC 2

Monitoring & Analytics

Subprocessor	Location	Purpose	Data Processed	Certifications
Google Cloud Operations	United States	System monitoring, logging	System logs, performance metrics (no PHI in logs)	SOC 2, ISO 27001
Sentry	United States	Error tracking, application monitoring	Error reports, stack traces (no PHI)	SOC 2 Type II

Support & Customer Success

Subprocessor	Location	Purpose	Data Processed	Certifications
[Support Platform TBD]	United States	Customer support ticketing	Support ticket content, contact info	SOC 2

Subprocessor Data Handling Summary

PHI Access

Subprocessor	PHI Access	BAA Executed
Google Cloud Platform	Yes	Yes
Google Gemini / Vertex AI	Yes	Yes
Pinecone	Limited (embeddings)	Yes
Google Identity	No	N/A
SendGrid	No	N/A
Stripe	No	N/A
Sentry	No	N/A

AI Training Restrictions

Our AI provider (Google) is contractually prohibited from:

Using Customer data for model training
Retaining data beyond request processing
Sharing data with third parties

Subprocessor Change History

Date	Change Type	Subprocessor	Description
[DATE]	Initial	All	Initial subprocessor list published

Data Flow & Processing Activities

High-Level Data Flow

User Upload → GCP Storage → Document AI (OCR) → Application Database (Cloud SQL)
                ↓
          AI Processing (Google Gemini) → Vector Embeddings (Pinecone)
                ↓
          Analysis Results → User Interface

Processing Activity by Subprocessor

Activity	Subprocessors Involved	Data Movement
Document Upload	GCP Storage, Cloud SQL	User → GCP (us-west1)
OCR/Text Extraction	Google Vertex AI, Document AI	GCP Storage → Vertex AI → Cloud SQL
AI Analysis	Google Gemini	Cloud SQL → AI API → Cloud SQL (results)
Semantic Search	Pinecone	Document text → Embeddings → Pinecone index
Authentication	Google Identity	Browser → Google Identity → Application
Notifications	SendGrid	Application → SendGrid → User email
Error Logging	Sentry	Application errors → Sentry (no PHI)

Geographic Boundaries: All data processing occurs within United States data centers. No cross-border transfers.

Regional Data Storage

Primary Region

Location: us-west1 (Oregon)
Subprocessors: GCP, Cloud SQL, Cloud Storage, Vertex AI
Data: All Customer data at rest

Secondary/DR Region (if applicable)

Location: us-central1 (Iowa)
Subprocessors: GCP (backup/DR only)
Data: Encrypted backups only

AI Processing Regions

Google Gemini / Vertex AI: US-based API endpoints (us-west1)
Pinecone: us-west1-gcp pod

Note: We do not store Customer data outside the United States.

Notification of Changes

Pursuant to our Data Processing Agreement:

New Subprocessors: Customers will receive at least 30 days' notice before a new subprocessor begins processing Customer data
Objection Period: Customers may object to a new subprocessor within 15 days of notification
Updates: This list will be updated when subprocessors are added or removed

How We Notify

Notification methods:

Email to registered account owner
In-app notification banner
Update to this page with highlighted changes
Optional: Slack/webhook notification (if configured)

Notification timeline:

Day 0: Subprocessor change announcement
Day 15: Objection deadline
Day 30: New subprocessor may begin processing

Subscribe to Updates

To receive email notifications of subprocessor changes:

Email: privacy@adjudica.ai
Subject: "Subprocessor Updates Subscribe"
Include: Company name, contact email, preferred notification method

Update frequency: Immediate notification upon subprocessor addition/removal

Customer Right to Object

Objection Process

If you object to a new subprocessor:

Step 1: Submit Objection (within 15 days of notification)

Email: privacy@adjudica.ai
Subject: "Subprocessor Objection - [Subprocessor Name]"
Include: Reason for objection, any alternative solutions you propose

Step 2: Provider Response (within 10 business days)

We will either:
- Work with you to address concerns (modify contract, additional safeguards)
- Provide alternative technical solution (if feasible)
- Discuss transition options if agreement cannot be reached

Step 3: Resolution

If concerns addressed: New subprocessor proceeds with additional safeguards
If alternative solution: Implementation of workaround
If no resolution: You may terminate services per DPA termination provisions

Valid Objection Grounds

Objections should be based on:

Security or privacy concerns specific to the subprocessor
Regulatory compliance conflicts
Jurisdictional restrictions
Contractual conflicts with your own obligations

Due Diligence

Before engaging any subprocessor, Glass Box Solutions conducts:

Security Assessment
- Review of security certifications (SOC 2, ISO 27001)
- Security questionnaire evaluation
- Penetration test results (where available)
Privacy Assessment
- Data handling practices review
- Privacy policy evaluation
- CCPA/HIPAA compliance verification
Contractual Requirements
- Data Processing Agreement execution
- Business Associate Agreement (where PHI is processed)
- Confidentiality provisions
- Audit rights
Ongoing Monitoring
- Annual security review
- Certification renewal verification
- Incident notification monitoring

Regulatory Compliance Mapping

HIPAA Compliance

All subprocessors that process PHI have executed Business Associate Agreements:

Subprocessor	BAA Status	BAA Date	Compliance Verified
Google Cloud Platform	✓ Executed	[DATE]	Annual
Google Gemini / Vertex AI	✓ Executed	[DATE]	Annual
Pinecone	✓ Executed	[DATE]	Annual

Verification: All BAAs reviewed annually and upon subprocessor security certification updates.

CCPA/CPRA Compliance

Subprocessors are designated as "Service Providers" under CCPA:

Service Provider Requirements Met:

✓ Written contract with enumerated business purposes
✓ Prohibition on selling/sharing personal information
✓ Prohibition on combining data outside contractual purpose
✓ Certification of understanding obligations
✓ Right to audit compliance

SOC 2 Type II Verification

Subprocessor	SOC 2 Type II	Report Date	Next Review
Google Cloud	✓	[DATE]	Annual
Pinecone	✓	[DATE]	Annual
Sentry	✓	[DATE]	Annual
SendGrid	✓	[DATE]	Annual
Stripe	✓	[DATE]	Annual

Monitoring: SOC 2 reports reviewed upon issuance; alerts set for expiration.

Incident Response & Breach Notification

Subprocessor Obligations

All subprocessors are contractually required to:

Notify Glass Box Solutions within 24-48 hours of becoming aware of any security incident
Provide incident details: Nature of breach, data affected, mitigation steps
Cooperate with investigation: Forensics, root cause analysis, remediation
Implement corrective measures: Address vulnerabilities, prevent recurrence

Our Response

Upon subprocessor breach notification:

Within 24 hours:

Assess Customer data impact
Begin internal investigation
Implement containment measures

Within 72 hours:

Notify affected Customers (per BAA/DPA)
Provide incident summary and impact assessment
Outline remediation steps

Ongoing:

Work with subprocessor on root cause analysis
Implement additional safeguards if needed
Provide regular updates to affected Customers
Re-evaluate subprocessor relationship if warranted

Audit Rights

Customer Audit Rights

Pursuant to our DPA and BAAs:

Customers may:

Request subprocessor security certifications (SOC 2, ISO 27001)
Request subprocessor BAA copies (if applicable)
Conduct annual audit of Provider's subprocessor management
Request evidence of subprocessor due diligence

Limitations:

Direct audits of subprocessors require subprocessor consent
NDA required for confidential subprocessor information
Audit frequency limited per DPA (typically annual)

How to request:

Email: compliance@adjudica.ai
Subject: "Subprocessor Audit Request"
Include: Specific information/certification needed

Questions

For questions about our subprocessors:

Privacy Team: privacy@adjudica.ai
Security Team: security@adjudica.ai
Compliance: compliance@adjudica.ai
DPA/BAA Questions: legal@glassboxsolutions.com

Support hours: Monday-Friday, 9am-5pm Pacific Time

Emergency security contact: security@adjudica.ai (24/7 monitored)

Document History

Date	Version	Changes
[DATE]	1.0	Initial publication
[DATE]	1.1	Added [Subprocessor Name]
[DATE]	1.2	Updated certifications

Current Version: 1.0

Next Scheduled Review: [DATE]

This Subprocessor List is updated periodically. Last update: [INSERT DATE]

Glass Box Solutions, Inc.

@Developed & Documented by Glass Box Solutions, Inc. using human ingenuity and modern technology