Sub-processors
Every third party that processes data on our behalf to run Lawzer, what each one does, and where it does it.
Disclosurev1.4In force from 24 September 2026
Drafted against
- Digital Personal Data Protection Act, 2023 — sections 8(2) and 16
- Data Processing Addendum, clause 6
1.The register
| Sub-processor | What it does | Data it can reach | Processing region |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge routing and the scheduled automation trigger | Customer content in transit; request logs | Serverless compute pinned to Mumbai (bom1). The company is US-incorporated; support access is governed by its own DPA. |
| Supabase (Supabase, Inc.) | The production database — every record in the application | All Customer content | Mumbai, India (ap-south-1). The application’s compute is in Mumbai too, so a query does not leave the country. |
| Vercel Blob | The evidence vault — uploaded acknowledgements, challans, resolutions, minutes and agreements | Uploaded files and their metadata | Mumbai, India (bom1). Objects are stored private and are readable only through the authenticated route in the application. |
| Resend (Plus Five Five, Inc.) | Delivery of statutory reminder emails and password-reset links. Not used where a deployment leaves the email variables unset, in which case reminders stay in the in-app inbox and no data reaches Resend at all. | Recipient name and email address, and the content of the message — which names the obligation, the entity it belongs to and its due date. No uploaded files and no other Customer content. | US infrastructure, under its own terms and DPA. Avoidable by not enabling email. |
| Google LLC — Firebase Authentication | Optional Google and federated email sign-in. Not used where a deployment leaves the Firebase variables unset, in which case no data reaches Google at all. | Email address, display name and Google account identifier of users who choose that door. No Customer content. | Google's global infrastructure, under its own terms. Avoidable by not configuring it. |
2.What we deliberately do not use
- No analytics or product-analytics provider. There is no Google Analytics, no Mixpanel, no Amplitude, no PostHog.
- No advertising or marketing-attribution network.
- No session-recording or heatmap tool. Recording a company secretary working a statutory file would capture confidential client data by design.
- No customer-support widget embedded in the application, which would run third-party script inside an authenticated workspace.
- No third-party fonts loaded at runtime beyond the Google Fonts stylesheet, which serves the typeface and receives no Customer content.
- No large-language-model API. The contract-vetting module is a structured checklist and a professional's own verdicts, not a generated opinion — so no Customer document is sent to a model provider.
This list is as much a part of the register as the first one. What a platform chooses not to embed tells a customer more about its data posture than what it has a contract with.
3.Changes to this register
- We give at least thirty days' notice before adding or replacing a sub-processor, by email to workspace administrators and by publishing a new version of this page.
- A Customer with a reasonable, data-protection-based objection may raise it within that period. We will try to resolve it; if we cannot, the Customer may terminate the affected subscription and take a pro-rated refund of the unused term.
- Where a change is forced on us at short notice — a provider withdrawing a service — we will notify as soon as we know and explain why the notice period could not be met.
To be told when this page changes, write to contact@lawzer.in and ask to be added to the notification list. Workspace administrators are on it automatically.
Read next
Data Processing AddendumThe terms on which Mallah Software Services Private Limited processes personal data as a Data Processor on a Customer's instruction, as section 8(2) of the Digital Personal Data Protection Act, 2023 requires to be under a valid contract.Privacy PolicyWhat personal data Mallah Software Services Private Limited collects through Lawzer, why, for how long, who else sees it, and how a person exercises their rights under the Digital Personal Data Protection Act, 2023.SecurityThe technical and organisational measures protecting Lawzer, the incident-reporting timelines Indian law imposes on us, and how to report a vulnerability.