Iusora Subprocessor Register (Legal)

Status: Pre-launch register. Last updated 2026-05-29. The public register lives at [/subprocessors](/subprocessors); the in-app Trust dashboard at [/app/trust](/app/trust) surfaces the same data.

This is the GDPR Article 28 sub-processor register for Iusora. Each entry lists vendor name, processing purpose, regional location of data, and the transfer mechanism where data leaves the EEA.

[LAWYER_REVIEW_REQUIRED — verbatim verification of each vendor's current sub-processor terms, residency claim, and SCC reference before this register is held out as a binding commitment to controllers.]

Tier A — primary processors

Magic (Magic Labs Inc.)

Purpose: passwordless authentication (Magic Embedded), DID issuance.
Region: EU (Magic publishes EU residency for European customers).
Data category: email address only (Magic does not see case data).
Transfer mechanism: EU SCCs Module 2 if any operational data routes through US infrastructure.
Reference: [Magic Privacy Policy](https://magic.link/legal/privacy-policy).

Neon (Neon Inc.)

Purpose: primary Postgres database, branch backups.
Region: EU (Frankfurt / eu-central-1).
Data category: user accounts, case records, findings, billing metadata.
Transfer mechanism: data does not leave the EEA in normal operation; Neon's control plane in the US is governed by SCCs Module 2 for any operational logs.
Reference: [Neon DPA](https://neon.tech/dpa).

Vercel (Vercel Inc.)

Purpose: Next.js application hosting, edge functions, CDN.
Region: EU edge regions for content; control plane in the US.
Data category: request logs (90 days), user IP addresses for fraud + abuse mitigation.
Transfer mechanism: SCCs Module 2 for control-plane data.
Reference: [Vercel DPA](https://vercel.com/legal/dpa).

Stripe (Stripe Payments Europe Ltd.)

Purpose: billing and payments (activates when Stripe integration ships in the deferred phase per 2026-05-29 directive — not collecting data today).
Region: EU (Stripe Payments Europe Ltd., Ireland).
Data category: Stripe customer identifier, plan tier, last 4 digits of card, billing address. Iusora never sees full card numbers.
Transfer mechanism: Stripe operates as data controller for payment instruments; Iusora is a downstream controller for the linkage between Stripe customer ID and Iusora user.
Reference: [Stripe DPA](https://stripe.com/legal/dpa) + [Stripe Privacy Policy](https://stripe.com/privacy).

Tier B — LLM + retrieval vendors

Anthropic (Anthropic PBC)

Purpose: foundation model inference (Claude family) for claim decomposition, inventive-step reasoning, report drafting.
Region: US.
Data category: claim text, descriptions, prior-art snippets submitted as prompts.
Transfer mechanism: EU SCCs Module 2. Anthropic's commercial terms state inputs and outputs are not used for model training.
Reference: [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy) + [Commercial Terms](https://www.anthropic.com/legal/commercial-terms).

Google Vertex AI (Google LLC)

Purpose: foundation model inference (Gemini Pro) as quorum co-vendor.
Region: europe-west1 (EU-resident; no cross-border transfer).
Data category: same as Anthropic.
Transfer mechanism: data does not leave the EEA when europe-west1 endpoint is used.
Reference: [Vertex AI data governance](https://cloud.google.com/vertex-ai/docs/general/data-governance).

EXA (EXA AI Inc.)

Purpose: web + patent retrieval for prior-art search.
Region: EU + US infrastructure.
Data category: search query text only (no user identifiers attached).
Transfer mechanism: SCCs Module 2 for US-routed queries.
Reference: [EXA Privacy](https://exa.ai/privacy).

Subscriber notification of new subprocessors

When we add or replace a subprocessor, we notify subscribers via:

1. Update to this register + the public [/subprocessors](/subprocessors) page. 2. In-app banner for 30 days in the Trust dashboard. 3. Email to billing contacts for Team + Enterprise plans.

Subscribers may object to a new subprocessor within 30 days of notification. If we cannot accommodate the objection, the subscriber may cancel for a pro-rata refund of the unused period per [/legal/terms](/legal/terms) §6.

Contact

Subprocessor questions: legal@iusora.com

---

Phase 2 commitment: this register will be machine-readable (JSON export) and integrated with `/api/trust/subprocessors` for live consumption by the Trust dashboard. Until that lands, this page + the in-app static list are the canonical source.