Last updated: 24 June 2026
Sub-processors
Rated Counsel Limited (t/a clmSpace) ("clmSpace", "we") acts as a processor on your documented instructions under our Data Processing Agreement. Your organisation is the controller. This register lists every sub-processor that processes customer contract data, the purpose, the categories of data processed and the hosting region. It is effective as of 24 June 2026.
The architectural principle is that your source contract documents stay in your own document store (SharePoint or Google Drive). clmSpace reads your documents in place through connectors you authorise. Derived structured contract data is held in a tenant-scoped Neon Postgres store in the United Kingdom, AI inference runs at Anthropic, and the backend and portal are hosted on Azure and Vercel.
| Sub-processor (legal name) | Purpose | Data categories | Hosting region |
|---|---|---|---|
| Microsoft Corporation | Cloud hosting for the backend service (Azure Container Apps), and Azure AI Document Intelligence to perform OCR on scanned PDFs. Where you connect SharePoint, clmSpace reads source contract documents in place in your own SharePoint through Microsoft Graph | Transient request and response payloads in the hosting layer; scanned pages sent for OCR; account identifiers used for sign-in | Azure UK South (United Kingdom) for hosting and OCR; SharePoint stays in your own Microsoft tenant |
| Neon, Inc. | Tenant-scoped Postgres store that holds derived structured contract data and powers fast lists, dashboards and counterparty views | Derived structured contract data only (agreements, obligations, citations, lifecycle state). No source contract documents | AWS London (United Kingdom) |
| Vercel Inc. | Hosting and content delivery for the customer portal. The marketing site runs as a separate Vercel project that processes no customer contract data | Portal request metadata and server-rendered or cached pages. Contract documents and derived contract data are not stored on this layer | Vercel, London region |
| Anthropic PBC | Claude AI inference for contract extraction, analysis and review. Under Anthropic's API terms and our commercial agreement, API data is not used to train models. Anthropic retains API data for up to 30 days for abuse monitoring | Prompts and the contract excerpts sent for extraction, analysis and review, plus the model's responses | United States. Transfers are covered by the UK IDTA referencing the EU Standard Contractual Clauses (processor to processor) |
| DocuSign Inc. | Optional, per-tenant electronic signature. Engaged only when a customer enables e-signature for their tenant | Documents sent for signature and signer metadata (such as names, email addresses and signing events) | DocuSign's processing locations under its own data processing terms; engaged only when enabled by the customer |
Data residency at a glance
- Backend service: Microsoft Azure Container Apps, UK South (United Kingdom).
- Source contract documents: your own SharePoint or Google Drive, read in place through connectors.
- Derived structured contract data: a tenant-scoped Neon Postgres store in AWS London (United Kingdom).
- Customer portal: Vercel, London region.
- AI inference: Anthropic, United States, covered by the UK IDTA referencing the EU Standard Contractual Clauses.
How we notify you of changes
We give at least 30 days’ notice before adding a new sub-processor or materially expanding the scope of an existing one, so that you have time to review and, where your agreement allows, object. Notices are sent to the contact your organisation registers with us, and this page is the authoritative, dated change log: each material change updates the register and the “Last updated” date above.
To subscribe to change notices, or to request the current version history of this register, email privacy@clmspace.com and ask to be added to the sub-processor change list.
Review cadence
Sub-processors are re-assessed at least annually against their published security attestations (such as SOC 2 and ISO 27001) or, where an attestation is not available, against our own documented risk assessment. Microsoft, Neon, Vercel and Anthropic maintain their own ongoing attestations, which we monitor for material changes.