Subprocessors

Jubal uses the providers below to run Jubal Law. This page names each one, what it does for us, and what data reaches it. We update it when the list changes.

Providers that process your client work

These providers store or process the documents, text, chats and audio a firm puts into Jubal.

• Amazon Web Services (storage, encryption, gateway, backups) — Encrypted storage of every document, the encryption keys, Jubal's model gateway, document conversion, and encrypted database backups. Data: All uploaded and generated documents; backups of the application database; request content passing through the gateway. Location: United States.
• Amazon Web Services (Amazon Bedrock) — AI models that run on AWS. Data: Prompts and the document text, page images and chat content a request needs; the model's responses. Location: United States. Written no-training terms: on file for Anthropic models; not yet on file for Grok models served by AWS.
• Amazon Web Services (Amazon Textract and Amazon Transcribe) — Reading text from scanned pages, and transcribing audio and video evidence. Data: Document page images; audio and video files added to a matter. Location: United States. Covered by the AWS AI-services opt-out on file; a separate no-training agreement for these services is not on file.
• xAI (X.AI LLC) — A partner model provider, used for applicable services and reached through Jubal's gateway. Data: Prompts and the document text and chat content a request needs; the model's responses. Never used for a matter marked as containing protected health information. Location: United States. Written no-training terms: not yet on file.
• Convex, Inc. — Jubal's application database and backend. Data: Matter and document details, extracted document text, summaries, chats, memory, tasks, calendar, parties, user and firm records, and the audit trail. Business associate agreement signed October 2, 2026.
• Deepgram, Inc. — Speech-to-text for voice dictation. Data: Dictation audio, streamed directly from the user's computer, and the resulting text. Only when a user dictates. Business associate agreement signed October 2, 2026. Written no-training terms: on file.
• Vercel Inc. — Hosting for jubal.law and the Jubal web application. Data: Web traffic, including web chat content in transit, sign-in session cookies, and IP addresses.

Providers that process account information

These providers handle sign-in, billing, email and error reports. They do not receive documents.

• WorkOS, Inc. — Sign-in and identity, including Sign in with Google. Data: Name, email address, profile picture, and the IP address and browser used to sign in.
• Google LLC — Sign in with Google. Data: Name, email address and profile picture. Only if a user chooses it.
• Stripe, Inc. — Subscription billing and payments. Data: Firm name, billing email, usage totals for invoicing, and payment details entered directly on Stripe's pages. Jubal never sees card numbers.
• send.dev, delivering through Amazon SES — Service email: sign-in codes, invitations, notices, deadline digests, statements and file requests. Data: Recipient names and email addresses, and the email's content, which can include firm, matter and client names and deadlines.
• Sentry (Functional Software, Inc.) — Error and crash reporting. Data: Technical error details such as app version and operating system. Configured not to send user identities. Location: United States.
• Cloudflare, Inc. and GitHub, Inc. — Delivering desktop app updates, and DNS. Data: IP address and app version when the desktop app checks for an update.

Research and lookup services

When a user, or Jubal on a user's request, looks something up, Jubal's gateway sends a short query to the service and logs the call. Documents are never sent. A query can contain a name or detail from the request, such as a party name in a docket search.

• binding.law — Statutes, regulations, case law and court formatting rules; citation checking. Data: Citations, search terms, court codes and case names.
• CourtListener (Free Law Project) — Case law and federal dockets. Data: Citations, case searches, and party names for docket searches.
• Federal Register, eCFR, U.S. Code and IRS — Official legal sources. Data: Search terms and citations.
• Google Places (Google LLC) — Business names and addresses. Data: A business name and a place.
• Brave Search (Brave Software, Inc.) — Web search. Data: Search queries. Only when a user asks Jubal to search the web.
• Public open-data portals — Public records lookups from city, county and state portals. Data: Topic words, a place, a street or a business name.
• Public websites a user asks Jubal to read — Capturing a web page as evidence. Data: The page address, requested from Jubal's servers and not from the user's computer.
• Browserbase, Inc. — Capturing a web page that refuses a direct capture. Data: The page address. Fallback only.

Training and health information

Jubal does not use customer content to train models. That is Jubal's own commitment and does not depend on a provider's terms. For a provider, the commitment is only as strong as its entry above says: “on file” means Jubal holds the provider's written terms and they prohibit training on customer content; “not yet on file” means this list does not make that statement.

Jubal has business associate agreements with Amazon Web Services, Convex and Deepgram. xAI is not covered by one. Jubal will sign a business associate agreement with a firm that asks; write to legal@jubal.law. A firm may upload medical records it or its client lawfully holds for a representation, as the Customer Terms describe. A matter marked as containing protected health information is never sent to xAI, and a personal-injury matter is treated as marked unless the firm states that it holds none. Marking does not by itself make the Service suitable for protected health information.

Questions

Write to privacy@jubal.law. See also the privacy policy and the security page.