Sub-processors
Last updated: 2026-08-19
This page is the canonical, current list of sub-processors that Trial Commander (Navarro Hernandez, P.L.) engages to process Customer Data on your behalf. It is the list referenced by § 7 of our Data Processing Agreement. We keep it here so changes are public and verifiable.
A sub-processor is a third party that processes Customer Data on our behalf. Each is engaged under data-protection obligations equivalent to those in our DPA, and we remain liable for their compliance.
Current authorized sub-processors
| Sub-processor | Purpose | Data Category | Location | Certifications |
|---|---|---|---|---|
| Clerk Inc. | Authentication | User identity, session | USA | SOC 2 Type II |
| Stripe Inc. | Payment processing | Billing info | USA | PCI-DSS Level 1, SOC 2 |
| Anthropic PBC | AI processing (Zero-Data-Retention tier) | Matter content for AI features | USA | SOC 2 Type II |
| Postmark (AC PM LLC) | Transactional email | Recipient info | USA | SOC 2 Type II |
| Sentry (Functional Software, Inc.) | Error monitoring | Stack traces (PII scrubbed) | USA | SOC 2 Type II |
| Cloudflare, Inc. (R2) | File storage | Uploaded documents | USA | SOC 2 Type II |
| Upstash Inc. | Rate limiting / Redis | IP, hashed user IDs | USA | — |
| Microsoft Corporation (Azure) | Application hosting and database | All Customer Data | USA (East US 2 — Virginia) | SOC 2 Type II, ISO 27001, HITRUST |
Notes on key processors
- Anthropic (AI). AI features run on Anthropic's Zero-Data-Retention tier — your matter content is not used to train models and is not retained beyond the request. AI processing is disclosed per Florida Bar Rule 4-5.3; see our AI Disclosure.
- Microsoft Azure / Cloudflare R2. Customer Data and uploaded documents are encrypted in transit (TLS 1.3) and at rest (AES-256); sensitive fields receive additional application-level field encryption.
- HIPAA. For firms handling PHI on the Complete or Enterprise tier, BAAs flow through to the relevant sub-processors. See the HIPAA Addendum.
Change note (2026-08-19). Database hosting moved from Supabase, Inc. to Microsoft Azure, consolidating application and database hosting with a single sub-processor. This reduced the number of sub-processors from nine to eight; no sub-processor was added, and no new category of data was disclosed to any party. The change was made before general availability, so no Customer Data was ever held by Supabase.
Notice of changes
We maintain this list at https://www.trialcommander.com/sub-processors. Material changes (adding a new sub-processor or materially changing the data a processor handles) require 30 days' advance notice to active Controllers. Controllers may object within 14 days of notice; we will work to address the concern or offer cancellation with a pro-rated refund of prepaid, unused fees.
To receive change notices, ensure your firm's billing/admin contact is current in Settings → Firm. Questions: privacy@trialcommander.com.
This list is operational and kept current as vendors change. The governing terms are in the Data Processing Agreement and Privacy Policy.