Draft — pending counsel review. This document is not yet in force.
Subprocessors
Entity: {{LEGAL_ENTITY}} · Product: CommitLayer · Draft updated 2026-09
Subprocessors
The following third parties may process Customer data on our behalf. Regions and purposes will be confirmed during counsel review.
- WorkOS — authentication (AuthKit, SSO). Processes account identifiers and email addresses.
- Stripe — billing. Processes billing contact and payment details; never receives verification data.
- Cloud hosting provider (to be named) — application hosting, database and object storage for connected data, statements and evidence.
- Language-model provider (to be named) — transcript assist only, when explicitly enabled by the Customer. Receives redacted excerpts of sampled conversations. Disabled by default.
- PostHog — product analytics, only when enabled in the deployment. Receives pseudonymous usage events.
- Sentry — error reporting, only when enabled in the deployment. Receives error traces which may include request metadata.
Notice of changes
We will give at least 30 days' notice before adding a subprocessor that processes Customer data.