Subprocessors

Overview

Suture AI LLC operates a multi-tenant workflow platform for U.S. professional services firms. To deliver its services, Suture engages a limited set of subprocessors — third-party vendors that may process data belonging to subscribing Customers (“Firm Data”). All subprocessors are contractually bound to process Firm Data only on Suture’s documented instructions. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256 or provider-managed equivalent). Suture’s contractual posture is zero data retention: AI providers are configured not to retain prompt or response content beyond the minimum required for request completion, and no prompt or response text is written to Suture’s own databases.

Subprocessors That May Process Firm Data

Subprocessors That Do NOT Process Firm Data

The vendors below support Suture’s internal operations but do not receive Firm Data:

Data Handling Posture

Encryption at Rest

• OAuth tokens (Gmail, MyCase): KMS envelope-encrypted per row. Each row carries a unique Data Encryption Key (DEK) generated by AWS KMS and wrapped with a Key Encryption Key (KEK). Encryption context: {firmId, connectionId} — a DEK cannot be used to decrypt a different row. Cipher: AES-256-GCM with 12-byte IVs and 16-byte authentication tags.
• Platform-admin OAuth tokens: separate PlatformOAuthConnection table with encryption context {platformAdminUserId, connectionId}; cannot cross-decrypt with firm-side rows.
• Database: Supabase-managed encryption at the storage layer.
• Discovery audio: Vercel Blob private mode with per-firm access control.

Encryption in Transit

• All API calls over HTTPS / TLS 1.2+.
• Webhook signatures verified before processing: Stripe HMAC, Clerk Svix, AssemblyAI per-job secret, AWS SNS for Textract.

Zero Data Retention

Suture’s primary commitment: prompt text and AI response text are never written to Suture’s own database.

• AiCall table stores model identifier, token counts, estimated cost in cents, duration, firmId, userId — never prompts or responses.
• UsageEvent table stores structural events (tool opens, action types, timestamps) — never form contents or PII.
• AuditEvent metadata is allowlisted per action type — no raw req.body literals.
• AssemblyAI: audio files deleted post-processing per ZDR contract; Suture retains only TranscriptionJob metadata.
• AWS Bedrock: ZDR by default per AWS data-processing terms; Anthropic does not see request content via Bedrock.
• Google Vertex AI: customer data not used to train Google models per Vertex AI data-processing terms.

Access Control

• Platform-administrator role conferred only via Clerk publicMetadata.role='platform_admin' set manually by Suture founders.
• 404-not-403 on /admin/* routes prevents enumeration by external parties.
• Platform-administrator impersonation re-verifies role on every request and writes an audit row.
• Firm-member isolation enforced at the Prisma query layer (every query requires a resolved firmId) plus an ESLint rule flagging unscoped queries.
• Human-in-the-loop required for any AI-generated content sent to clients, opposing counsel, or courts.

Breach Notification

• 24-hour notification commitment to affected Customer Firms.
• Audit log surfaces unauthorized access attempts for incident investigation.

Data Retention

• AiCall + UsageEvent + AuditEvent: 18-month default retention.
• Signed contracts and LOIs: 7-year legal hold.
• Firm-exported data: available at any time during the engagement; full export on termination with a 30-day window.
• S3 staging PDFs (Textract input): 24-hour auto-delete via bucket lifecycle rule.
• AssemblyAI audio: deleted post-processing per ZDR contract.

BAA / DPA Status Summary

Reference Documents

For the legal terms that govern Suture’s handling of Firm Data, see the Data Processing Addendum, the Privacy Policy, and the Terms of Service.