Klarefi engages the following subprocessors to deliver the service. Each is bound by data protection obligations materially no less protective than our data processing agreement. Customer case content, document storage, the primary application, and document parsing are EU-hosted by default. AI inference runs on CoreWeave in the United States, which receives the document text and page images it reads. Identity, billing, email, status, and encrypted-backup providers may also process the limited categories shown below outside the EEA. Transfers outside the EEA are covered by standard contractual clauses or another recognized transfer mechanism. Besides AI inference, email is the one of these that carries case content: an offer a customer sends to an applicant, and an enquiry an applicant sends in.
On an enterprise agreement, a customer can run AI inference through its own model account on Azure, AWS, or Google Cloud, in a region it chooses. That provider then works under the customer's own agreement and is not a Klarefi subprocessor for those cases.
A customer can connect its own Gmail or Google Workspace account in its email settings. Its emails to applicants then go out through that account and not through Resend. Where the customer also lets Klarefi read that mailbox, enquiries sent to its forms are read from it and not received through Resend. Google handles those emails under the customer's own agreement with Google and is not a Klarefi subprocessor for them.
Railway
- Purpose
- Infrastructure hosting for the web application, document processing workers, database, and object storage for uploaded files.
- Data categories
- All customer data handled by the service: account data, intake responses, case documents, and workflow records.
- Location
- EU
CoreWeave
- Purpose
- AI model inference for reading documents, extracting facts, and running checks. Common high-sensitivity patterns are minimized before supported text calls. Applicant documents and case content are processed only to return the model's answer, and Klarefi does not authorize their use to train shared models.
- Data categories
- Document text, intake responses, and document page images submitted for inference. Names, addresses, and other context may remain when needed to perform the workflow.
- Location
- US
WorkOS
- Purpose
- Authentication, single sign-on, and organization membership.
- Data categories
- User account and contact data, such as names, email addresses, and organization membership. No case data.
- Location
- EU and US
Stripe
- Purpose
- Payments, billing, and subscription administration.
- Data categories
- Billing contact and payment data only. No case data.
- Location
- EU and US
Resend
- Purpose
- Sending service emails, and emails to applicants in a customer's name, such as the reply to an enquiry, an offer, a reminder, or a signed copy. Receiving the emails an applicant sends to a form's email address.
- Data categories
- Sender and recipient names and email addresses, and the content of those emails. That includes the text of an offer and the files sent with it, and the text of an applicant's enquiry.
- Location
- EU and US
Cloudflare
- Purpose
- Serving the public status page and storing off-platform backup copies. Backups are encrypted before they leave Klarefi's infrastructure.
- Data categories
- Encrypted backup copies of customer data. The status page serves no customer data.
- Location
- EU and US
DataFast (consent-gated)
- Purpose
- Consent-gated public-site and product analytics, limited to acquisition and activation measurement.
- Data categories
- Usage and device data, a pseudonymous browser visitor identifier, and low-cardinality activation events. No account identity, organization identity, applicant, or case data.
- Location
- EU and US
Axiom (privacy-minimized allowlist)
- Purpose
- EU-hosted service observability, error monitoring, and reliability diagnostics.
- Data categories
- Allowlisted operational metadata such as service, route, status, duration, job type, processing counts, and random request or job identifiers. No applicant identifiers, raw errors, request bodies, document names, case content, extracted values, or evidence text.
- Location
- EU
Locations describe where the provider processes personal data for Klarefi's default deployment. Deployment-specific residency commitments are set out in the applicable customer agreement.
Providers receiving applicant documents or case content may process that data only to deliver the contracted service. Klarefi does not authorize subprocessors to use it to train shared models. Public-site analytics and privacy-minimized service telemetry do not include raw applicant documents, extracted values, or evidence text.
Changes to this list are posted here first. To receive notice of subprocessor changes by email, write to legal@klarefi.com with the subject "Subprocessor notifications" and the organization you represent.