Effective date: July 15, 2026
Last updated: July 22, 2026
Short version
- Stetful uses service providers to host, authenticate, store, process, secure, and operate the Service.
- Application logging rules prohibit customer legal content, raw extracted text, source identity, filenames, and storage keys from broad logs; security and provider systems may still process bounded request data under their stated purposes.
- Stetful does not use Customer Legal Content to train foundation models or third-party models. This no-training commitment is separate from provider retention for service delivery, abuse and security monitoring, support, or legal compliance.
- Optional voice dictation sends raw audio transiently through Stetful to OpenAI for transcription. Stetful does not persist the recording or maintain a separate dictation transcript history.
- This disclosure does not promise an SLA, DPA, data residency, certification, processor-only mode, zero data retention, or “eyes off” processing.
- Report vulnerabilities to security@stetful.com.
1. Scope
This disclosure summarizes Stetful’s subprocessors and security posture for the initial U.S. launch. It is factual and modest. It is not a SOC 2 report, SLA, DPA, BAA, penetration-test report, or security certification.
2. Subprocessor list
| Provider | Purpose | Data categories | Location / region notes | AI training / retention notes |
|---|---|---|---|---|
| Vercel | Hosting, deployment, runtime infrastructure for web and marketing apps | Request and response metadata, runtime data necessary to serve the app, deployment and build data | U.S. and global infrastructure; exact region varies | Not an AI model provider. Application logging rules prohibit customer legal content in broad logs. |
| Clerk | Authentication, sessions, user and organization management | User account data, email, authentication and session data, organization and role data | U.S. and global infrastructure | Not an AI model provider. |
| Neon / Postgres | Operational database and durable worker queue | Operational records, Legal-State Data, metadata, review receipts, job metadata | U.S. production configuration | Not an AI model provider. |
| Cloudflare R2 or other S3-compatible object storage | Evidence object storage | Uploaded evidence files, pre-account attachments, object metadata | U.S. and global infrastructure; provider and region depend on production configuration | Not an AI model provider. Object keys are tenant-scoped and opaque. |
| OpenAI | Optional voice transcription, AI-assisted classification, extraction support, answer drafting, structured outputs, and related AI processing | Raw audio submitted for dictation, transcript output, bounded inputs, extracted text where needed, other outputs, and request metadata | Processed according to configured API settings | API inputs and outputs are not used for model training by default. Default abuse-monitoring logs may retain content for up to 30 days; eligible approved controls can differ. Limited human review may occur for abuse, security, support, or legal purposes under provider controls. Stetful's transient handling does not override OpenAI's applicable retention settings. |
| GitHub | Source control, CI, deployment and operations automation | Code, configuration, CI logs, synthetic test data, repository metadata | U.S. and global infrastructure | Customer legal content and secrets must not be placed in source control or CI logs. |
| Google Workspace / Gmail | Inbound and outbound support, legal, privacy, and security communications | Email address, message contents, attachments intentionally sent to Stetful | U.S. and global infrastructure | Do not include unnecessary Customer Legal Content in email. |
Provider names describe the current supported architecture and must be reverified against production configuration before activation and before material changes. “Other S3-compatible object storage” is not a promise that every listed alternative is active.
3. Security posture
Stetful’s initial security posture is built around minimum viable trust:
- tenant boundaries for organization-scoped objects and role or capability checks for write and review surfaces;
- tenant-scoped, opaque object-storage keys for uploaded evidence;
- application logs and worker results designed to exclude customer legal content, raw extracted text, source identity, filenames, storage keys, tenant interpretations, accepted state, and operational conclusions;
- source-redacted party-scoped presentation that does not reveal a contributing customer or artifact;
- authorization that distinguishes a named contractual party from an unrelated third party;
- proposed state changes that require company review before accepted state;
- secrets kept in secret stores rather than committed to the repository;
- tracked-file secret scanning and CI gates; and
- a public vulnerability contact at security@stetful.com.
No system is perfectly secure. Provider infrastructure may process bounded request, security, and abuse-monitoring data under provider terms even where Stetful application logs exclude legal content.
4. What Stetful does not claim at initial launch
Unless separately true, agreed, operationally supported, and published, Stetful does not claim:
- SOC 2, ISO 27001, HIPAA, FedRAMP, PCI DSS, or another certification or regulated-service status;
- a penetration-test cadence, public bug-bounty program, uptime SLA, support SLA, recovery SLA, or deletion SLA;
- a signed DPA, BAA, SCC package, processor-only mode, customer-managed keys, dedicated infrastructure, regional pinning, data residency, universal zero data retention, or “eyes off” provider processing;
- that no service provider can ever access customer data; or
- that the Service is perfectly secure, uninterrupted, or error-free.
Enterprise restrictions are separately negotiated overlays that narrow the standard customer profile. This page does not itself offer or promise those restrictions.
5. Vulnerability reporting
If you believe you found a vulnerability, contact security@stetful.com.
Please include enough information to help Stetful understand and reproduce the issue, but do not include unnecessary Customer Legal Content, secrets, personal data, or third-party confidential information.
Stetful does not authorize destructive testing, denial-of-service testing, social engineering, spam, physical attacks, or attempts to access another customer’s data.
6. Updates
Stetful will update this disclosure before adding a new subprocessor that materially processes customer legal content or before materially changing the AI-provider, storage, auth, hosting, or database posture.