Wythe uses the third-party providers below to operate the Service. Primary application data — your account, your Wythe AI matter content, and the public research corpus — is stored in United States regions. We review each provider before engaging it and reassess periodically. This page is the reference for our Security & Trust page and Privacy Policy.
Infrastructure and platform
These providers process account data and, where noted, matter content.
| Provider | What it receives | Purpose | Independent audits |
|---|---|---|---|
| Supabase | Account data, Wythe AI matter content, usage metadata (database). | Managed PostgreSQL database, authentication, and row-level security. | SOC 2 Type II, ISO 27001, HIPAA (BAA available). |
| Vercel | HTTP request traffic and edge/function logs. | Application hosting and edge delivery. | SOC 2 Type II, ISO 27001. |
| DigitalOcean | Uploaded matter files and public corpus PDFs (object storage); the background AI worker runs here. | Object storage and background compute. | SOC 2 Type II, SOC 3. |
| Cloudflare | Request traffic and IP address; sign-up/reset bot-challenge tokens (Turnstile). | DNS, edge protection, and bot challenge. | See provider trust hub. |
| Stripe | Billing contact and payment details (full card numbers never touch Wythe). | Payments and subscription billing. | PCI DSS Level 1, SOC 2. |
| Email delivery provider | Recipient email address. | Sign-in links, account notices, and support email. | See provider trust page. |
AI processing (matter content)
These providers process your Wythe AI matter content to fulfill your requests. They are contractually barred from training their models on it, and retain it only transiently to serve the request; we are pursuing formal zero-data-retention terms. See the Security & Trust page.
| Provider | What it receives | Purpose | Independent audits |
|---|---|---|---|
| Anthropic | Wythe AI matter content during AI runs (prompts, matter files, instructions); public corpus text. | AI drafting and research; public-corpus processing. | SOC 2 Type II, ISO 27001, ISO 42001. |
| Mistral AI | Uploaded scanned matter PDFs for OCR; public corpus PDFs. | Optical character recognition (OCR). | See provider trust page. |
Public-corpus processing only
These providers process the public-record FEC corpus only. They never receive your matter content.
| Provider | What it receives | Purpose | Independent audits |
|---|---|---|---|
| Public FEC corpus PDFs only — never matter content. | Corpus OCR recovery. | See provider compliance center. | |
| Voyage AI | Public FEC corpus text only — never matter content. | Corpus embeddings for search. | See provider trust page. |
Optional search (off by default)
These providers receive model-composed search queries only when you turn on web or case-law search for a matter or chat. Your uploaded documents are never sent to them; the queries may reflect the substance of what you are researching, which is why the feature is opt-in.
| Provider | What it receives | Purpose | Independent audits |
|---|---|---|---|
| Brave Search (via Anthropic) | Model-composed search queries only, and only when you enable web search. Never your documents. | Web search results for Anthropic's web-search tool. | Anthropic subprocessor. |
| CourtListener (Free Law Project) | Model-composed case-law queries only, and only when you enable case-law search. Never your documents. | Public case-law lookup. | Nonprofit; public court data. |
About the “independent audits” column
We list only certifications we have confirmed for a provider. Where a cell says “see provider,” refer to that provider's linked trust page for their current attestations — we would rather link you to the source than restate a badge we have not verified for this page. Certification status changes; the provider's trust center is always authoritative.
Changes
We may add or change subprocessors as the Service evolves. Questions about this list, or a request to be notified of changes to subprocessors that handle matter content? Email info@wytheintelligence.com.