Vendor register · Reviewed July 24, 2026
The service providers visible in the current application, the data they can receive, and the limits of our residency statements.
“Subprocessor” has a specific legal meaning. Some providers, including a merchant of record, may act as an independent controller for part of their service. This operational register describes data flow; it is not a substitute for signed contract terms or provider notices.
Provider
Purpose
Hosting and edge infrastructure
Data categories
HTTP request metadata, application logs, deployment assets, and server-side application processing.
Location and evidence
Global edge network. Vercel documents that Functions default to the United States unless a region is selected and that data may be processed globally.
Security and complianceProvider
Purpose
Database, authentication, and private object storage
Data categories
Account records, firm/client metadata, request metadata, encrypted document payloads, and wrapped cryptographic keys.
Location and evidence
Each project has one selected primary region. The current project region is configuration-dependent and is not presented here as a contractual residency commitment.
Available regionsProvider
Purpose
SMS delivery
Data categories
Recipient phone number, message body containing the secure upload link, and delivery metadata.
Location and evidence
Twilio documents processing locations and onward providers in its current subprocessor register; carrier routing can cross jurisdictions.
Twilio subprocessorsProvider
Purpose
Transactional email delivery
Data categories
Recipient email address, message subject and body, secure upload link, and delivery metadata.
Location and evidence
Resend states that its primary processing operations take place in the United States and documents transfer safeguards in its DPA.
Resend DPAProvider
Purpose
Firm assistant model provider
Data categories
User-entered prompts, firm context, and tool results needed to answer operational questions. Document files are not intentionally attached by the current agent route.
Location and evidence
Processing and retention depend on the Gemini API service tier and features in use. DocuChase does not publish a zero-retention claim for this integration.
Gemini data retentionProvider
Purpose
Merchant of record and billing provider
Data categories
Buyer identity, email, selected product, transaction, tax, fraud, and payment metadata. Payment details are entered in Dodo-hosted checkout.
Location and evidence
Dodo describes its controller and processor roles, international transfers, and safeguards in its current DPA.
Dodo Payments DPAProvider
Purpose
Browser asset delivery
Data categories
Network request metadata such as IP address and user agent when browser workers or OCR assets are fetched. Document content is processed locally in the browser.
Location and evidence
Global content delivery networks. Their edge routing is not a document-storage location.
Cloudflare privacyThe codebase confirms which providers are used, but it does not prove the selected Supabase project region, every Vercel runtime location, or a customer-specific contractual restriction. Those values must be verified against the live provider accounts before DocuChase makes a contractual commitment.
For a current questionnaire response, provider-document request, or notice about this register, email security@docuchaseapp.com. Provider registers can change independently; linked provider documentation is authoritative for their current downstream vendors.