Legal
Subprocessors
Last updated: October 25, 2026
1. Overview
This page lists the third-party subprocessors and vendors that ModulawAI engages to deliver the Platform. It is the authoritative source: the lists embedded in our other policy documents (Privacy Policy, Data Protection Policy, Data Processing Agreement) point here.
Each subprocessor is bound by a written agreement containing confidentiality, security, and (where applicable) data-protection obligations equivalent to those in our DPA. Where a vendor offers a no-training assurance for AI inputs, we rely on that contractual commitment. Section 4 says which AI vendors that applies to.
Where your data is processed. We host the Platform in the United States on Amazon Web Services (us-east-2, Ohio), where we run our own databases. Our team at ModulawAI Nigeria Limited administers and supports the Platform from Nigeria and may access data when needed to do so. Live call audio and video are relayed through our own server on Amazon Web Services in South Africa. Some providers process data in other countries, as shown below. We do not process customer data in the European Economic Area or the United Kingdom.
How transfers are protected. For personal data from the EU/EEA or the UK, our own transfers rely on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as set out in our Data Processing Agreement, and the UK International Data Transfer Addendum. We make onward transfers to the subprocessors below only where a transfer mechanism recognised by data protection law is in place, such as the Standard Contractual Clauses and UK Addendum in the subprocessor’s terms.
2. Notification of changes
We notify enterprise customers at least 30 days before adding a new subprocessor that processes Personal Data on our behalf, in line with our Data Processing Agreement, §6. Customers may object within that window by emailing dpo@modulaw.ai; if we cannot reasonably accommodate the objection, the affected services may be terminated without penalty.
Objections and policy correspondence are reviewed by our Chief Legal Officer (see our Data Protection Policy, §17), independent of engineering and product operations.
To receive change notifications, subscribe by emailing dpo@modulaw.ai with the subject line “Subprocessor updates”.
3. Infrastructure & storage
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Primary hosting: application servers (EC2), databases (MongoDB that we run ourselves on EC2, encrypted and reachable only from our private network), file storage (Amazon S3), cache (Amazon ElastiCache), logs (Amazon CloudWatch), web app delivery, and hosting for the ModulawAI for Word add-in | United States (us-east-2, Ohio; us-east-1 for content delivery) |
| ModulawAI Nigeria Limited | Administration, engineering and support. Accesses service data only when needed to operate and support the Platform | Nigeria |
4. AI / inference
| Provider | Purpose | Location |
|---|---|---|
| AWS Bedrock (Amazon Web Services) | Hosted AI models, including Anthropic Claude, Amazon Nova and open-weight models (such as Qwen, Llama, Kimi and gpt-oss), and embeddings. Our account is set to zero data retention, with model invocation logging off | United States |
| Amazon Textract (Amazon Web Services) | Reading text from scanned documents (OCR) | United States |
| Fireworks AI | Open-weight AI models and image generation. Zero data retention by default for the models we use | United States |
| OpenRouter | Routes text-embedding requests (text-embedding-3-large) to Microsoft Azure’s zero-data-retention endpoint | United States |
| LangSmith (LangChain) | Monitoring of AI runs. In production, prompts and outputs are hidden: only metadata (ids, timings, errors) is sent, and traces are kept for 14 days | United States |
Each AI provider receives only the prompt and context needed to answer a request. Under their terms for our account, AWS Bedrock, Fireworks AI and the Azure embedding endpoint we reach through OpenRouter do not keep your prompts or outputs and do not use your content to train their models. Deepgram is called with its model-improvement opt-out on every request. Amazon Textract is covered by our AWS Organizations AI services opt-out, so AWS does not store or use the documents it reads to improve its services. ElevenLabs, Cartesia, TinyFish and Tavily process data under their own standard terms, and we send them only what their function needs. ModulawAI itself never uses your content to train AI models.
5. Voice & real-time
| Provider | Purpose | Location |
|---|---|---|
| LiveKit (self-hosted by ModulawAI on AWS) | Real-time relay of call audio and video for the AI voice agent and call features. Runs on our own server; no LiveKit-hosted service receives the media | South Africa (AWS af-south-1, Cape Town) |
| Deepgram | Speech-to-text transcription, with model-improvement opt-out on every request | United States |
| ElevenLabs | Text-to-speech voice synthesis for AI responses | United States |
| Cartesia | Text-to-speech fallback provider | United States |
| Africa’s Talking | SMS, phone calls and call recording. Recordings are copied to our own storage | Kenya / Nigeria |
6. Messaging, payments, security
| Provider | Purpose | Location |
|---|---|---|
| Paystack | Payment processing (NGN subscriptions, invoices, seat purchases) | Nigeria |
| Stripe | Payment processing (non-NGN subscriptions) | United States |
| ZeptoMail (Zoho) | Transactional email delivery (OTP codes, receipts, booking confirmations) | India / US |
| WhatsApp Business / Meta | OTP and booking notifications where the user opts in | United States |
| Google (reCAPTCHA, Firebase Cloud Messaging) | Bot protection on public forms; push notifications | United States |
7. Research & legal data
| Provider | Purpose | Location |
|---|---|---|
| CourtListener | US case law lookup and citation verification | US |
| CanLII | Canadian case law lookup | Canada |
| EUR-Lex | EU legislation lookup (public database; receives the search query only) | EU |
| TinyFish | Browser-based citation verification for jurisdictions without an official API (UK, Ghana, Kenya, South Africa) | US |
| Tavily | Web search augmentation for research queries | US |
Public legal databases (CourtListener, CanLII, EUR-Lex) receive only the search query you run, the same as any visitor to those sites. TinyFish and Tavily receive the citation or search query only, never the body of your documents. Please do not put client names or confidential facts in research queries.
8. Analytics & marketing
All entries here are consent-gated. Optional cookies are off by default; see our Cookie Policy for the list of cookies set by each provider.
| Provider | Purpose | Location |
|---|---|---|
| Google Analytics (GA4) | Website analytics (pseudonymous, consent only) | US |
| Microsoft Clarity | Behavioral analytics (masked) | US |
| Meta (Facebook Pixel) | Marketing attribution | US |
| TikTok Pixel | Marketing attribution | US |
| X / Twitter Ads | Marketing attribution | US |
| Apollo | Marketing attribution | US |
9. User-authorised integrations
These are not subprocessors in the traditional sense. Users (or workspace administrators) choose to connect their own accounts and we act on their authorised instructions. Data flows to and from these systems are governed by the third party’s own terms.
| Provider | Purpose |
|---|---|
| Google Workspace (Gmail, Calendar, Drive) | Email, calendar, document access on user authorisation |
| Microsoft 365 (Outlook, OneDrive, Teams Calendar, Word add-in) | Email, calendar, document access on user authorisation |
| Zoho (CRM, Mail, Bookings) | CRM / email / scheduling sync on user authorisation |
10. Changelog
Most recent changes first. Older changes archived after 24 months.
October 25, 2026
- Removed: MongoDB Atlas (MongoDB, Inc.). Both of our Atlas database clusters were terminated on October 25, 2026, and no copies were kept with MongoDB. Our databases run in ModulawAI’s own AWS environment (us-east-2).
October 24, 2026
- Changed: our databases now run in ModulawAI’s own AWS environment (us-east-2), on servers we manage, encrypted and reachable only from our private network.
- Being removed: MongoDB Atlas. Its clusters are paused and will be terminated by October 30, 2026; it will then be deleted from this list. No subprocessor was added.
October 15, 2026
- Removed: Microsoft Azure Blob Storage. All files are now stored in Amazon S3 and the Azure storage account has been deleted.
- Removed: direct use of Microsoft Azure OpenAI. Text embeddings are created only through OpenRouter, routed to Microsoft Azure’s zero-data-retention endpoint, and the direct Azure OpenAI resource has been deleted.
October 13, 2026
- Corrected: hosting locations. The Platform runs on Amazon Web Services in the United States (us-east-2) with MongoDB Atlas on AWS us-east-1. Microsoft Azure is no longer our primary host; it is used only for legacy file storage and text embeddings. No customer data is processed in the EU, and the earlier "US / EU" locations have been removed.
- Added (newly disclosed): ModulawAI Nigeria Limited (administration and support from Nigeria); self-hosted LiveKit relay on AWS in South Africa; Amazon Textract; OpenRouter (embedding routing); Africa’s Talking; Google Firebase Cloud Messaging.
- Removed (no longer used at runtime): Pinecone (embeddings are stored in our MongoDB database), Azure Document Intelligence, Anthropic direct API (Claude models are reached through AWS Bedrock), Bing Search API, Google Custom Search, and Redis on Azure (cache now runs on Amazon ElastiCache). Neo4j, which we use for a citation graph built from public case law, removed from this list.
- Updated: LangSmith now receives run metadata only (prompts and outputs hidden in production; 14-day retention). Added where data is processed and how EU and UK transfers are protected.
June 12, 2026
- Added: Stripe (payment processing for non-NGN subscriptions in regions outside Nigeria). Paystack continues to process NGN payments.
May 15, 2026
- Added: Fireworks AI (open-weight reasoning model inference).
- Added: AWS, formalised as a category for AWS Bedrock inference and AWS Amplify hosting of the ModulawAI for Word add-in.
- Added (newly disclosed): LiveKit, Deepgram, ElevenLabs, Cartesia (voice stack); ZeptoMail (transactional email); WhatsApp Business (OTP); Google reCAPTCHA; Tavily, Bing Search, Google Custom Search; CourtListener, CanLII, EUR-Lex; Neo4j, Redis, Azure Document Intelligence; LangSmith (optional). These vendors were previously in use but not all named in policy text; this update brings the disclosure list in line with what’s actually deployed.
- Disclosure expanded: AI provider list now explicitly names Anthropic, AWS Bedrock, Azure OpenAI, and Fireworks AI in Privacy Policy and Data Protection Policy (previously inconsistent across documents).
March 22, 2026
- Data Protection Policy first published with subprocessor table listing MongoDB Atlas, Microsoft Azure, Azure OpenAI Service, Pinecone, Paystack, Google Analytics, Microsoft Clarity, Meta, TikTok.
11. Contact
Questions about subprocessors, notification subscriptions, or objections to a planned change: dpo@modulaw.ai.