Draft template — pending legal review

This page is an engineering draft for procurement and counsel review. It is not final legal advice. Questions: security@clarika.co.ke.

Sub-processors

v2026-06-01 · Effective 2026-06-01 · Updated 2026-06-24

Sub-processor List

Clarika uses the following sub-processors to provide the Service. This list is versioned for enterprise procurement and DPA compliance.

Draft template: Regions and legal bases are engineering estimates pending counsel review. Confirm production regions before customer signature.

Current version: 2026-06-01
Effective date: 1 June 2026

Sub-processors

Sub-processor	Purpose	Processing location (draft)	Legal basis (draft)
Supabase	Authentication, hosted PostgreSQL database	Region configured per deployment (commonly EU or US)	Contract; legitimate interest (security)
MinIO / S3-compatible storage	Document object storage (uploaded files)	Customer / deployment region	Contract
Reducto	OCR and document extraction API	United States	Contract; international transfer safeguards (SCC / TIA)
Anthropic	LLM schema generation and related API calls	United States	Contract; international transfer safeguards (SCC / TIA). Production keys should use zero-data-retention / no-training options where available
Resend	Transactional email (verification, notifications, onboarding)	United States / European Union (Resend infrastructure)	Contract
Sentry	Error monitoring and operational diagnostics	European Union (recommended project region)	Legitimate interest (service reliability); PII scrubbing applied
PostHog	Product analytics (optional, consent-gated)	European Union	Consent (cookie banner)
Twilio	SMS verification for profile security (when enabled)	United States	Contract

Notes

Customer Content (documents and extractions) is stored in your workspace-scoped database and object storage configured for your deployment.
We do not use sub-processors to sell personal data or for unrelated advertising.
Optional services (Twilio SMS, PostHog analytics) apply only when configured or when you accept optional cookies.

Change notification

We will update this page when we add or replace sub-processors that process Customer Content. Material changes are communicated to workspace administrators with at least 30 days' notice where required by your DPA or order form.

Changelog

Version	Effective date	Summary
`2026-06-01`	2026-06-01	Initial published draft list (Supabase, MinIO, Reducto, Anthropic, Resend, Sentry, PostHog, Twilio)

Contact

Sub-processor questions: security@clarika.co.ke