Last updated: September 21, 2026
Every vendor that touches any part of Sidebar, what each one can see, and what it keeps. We update this page, and notify customers by email or in the service, when we add a subprocessor.
| Vendor | Role | What it sees | Region | What it keeps |
|---|---|---|---|---|
| Supabase | Database & file storage | Your saved workspace: content encrypted app-layer (AES-256-GCM); titles/matter labels and uploaded original files protected by access controls and disk encryption | United States (us-east-1) | Until you delete it |
| Vercel | Application hosting and page analytics | Request/response traffic in memory while serving you; server logs (metadata); cookieless page-view counts (page address and referrer, never workspace content) | United States | Ephemeral compute; short-lived logs; aggregate page-view statistics |
| Clerk | Authentication | Your email, identity, firm membership, sessions | United States | While your account exists |
| Cloud AI and compute services (run inside Sidebar's own cloud account) | Document generation, document search (text embeddings and reranking), reading scanned documents (OCR), and some AI models | Document-generation payloads, document text and page images, and prompts and responses, during processing | United States | No content after processing (structural logs only) |
Backups and disaster-recovery copies are managed by our database provider within the same United States region and the same isolation and encryption boundary; deleted data expires from them in the ordinary course, and backups are not restored except to recover the service. The names of the underlying cloud providers are available to customers on request.
Every AI model is reached only over channels covered by written zero-retention terms, which prohibit retaining your content after a request is processed and using it to train models. Where a provider offers a no-retention setting, we enforce it in code on every request.
| Vendor | Role | What it sees | What it keeps |
|---|---|---|---|
| Anthropic (Claude) | AI models | Prompt + response during inference, reached only over channels covered by written zero-retention terms | Nothing retained; never used for training |
| OpenAI (GPT) | AI models | Prompt + response during inference, storage disabled (store: false) on every request | Nothing retained; never used for training |
| Google (Gemini) | AI models | Prompt + response during inference, under written zero-retention terms | Nothing retained; never used for training |
| AI Gateway (Vercel) | Routes requests to some models | Prompt + response in transit only; zero-retention mode is enforced on every request, and a request that cannot honor it fails instead of falling back | Nothing |
When you run legal or web research, Sidebar sends the search text to these services. No account or firm identifiers are attached.
| Vendor | Role | What it sees | What it keeps |
|---|---|---|---|
| CourtListener (Free Law Project) | Case-law search & opinions | Model-composed search queries; no account or firm identifiers attached | Standard service logs on their side; retrieved opinions are public documents |
| Brave Search | Web search (when enabled) | Model-composed search queries; no account or firm identifiers attached | No-retention search tier |
Honest caveat: research queries are composed by the model from your conversation, so the query text itself can reflect matter details even though we attach no identifiers. This is inherent to any web-grounded research tool. For matters too sensitive for external queries, leave research off.
These apply only to an attorney who chooses to connect their own Google account. Nothing is connected on anyone's behalf, a firm administrator can switch the feature off for the whole firm, and the attorney can disconnect at any time. Google is the provider of the attorney's own account, not a subprocessor. Composio is a subprocessor.
| Vendor | Role | What it sees | What it keeps |
|---|---|---|---|
| Google (Drive and Gmail) | The attorney's own Drive and mailbox, reached only when the attorney asks | The searches and read requests Sidebar makes under that attorney's own Google authorization | It is the attorney's own account; an email is sent only when the attorney presses Send on that specific draft |
| Composio (Sampark, Inc.) | Connection service between Sidebar and Google | Requests and responses in transit; holds the attorney's Google credentials, encrypted | Activity metadata only (action, time, status); configured not to store contents. A file being read is staged in temporary storage that Composio deletes (about 24 hours, according to Composio's documentation) |
Google's permission screen names Composio and lists full access to mail or Drive, because Google approves Composio's application for full access only. Sidebar's use of that access is limited to searching and reading what the attorney asks for and preparing drafts the attorney sends. Sidebar does not edit, move, share or delete Drive files, does not delete, archive, label or change mail, does not send mail on its own, and does not sync or index a Drive or mailbox in the background.
Sidebar's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
| Vendor | Role | What it sees | What it keeps |
|---|---|---|---|
| Stripe | Billing | Payment details and billing identity — never workspace content | Standard financial-records retention |
There is no separate email, advertising, session-replay or customer-support subprocessor beyond the above. Authentication email is handled by Clerk. Page analytics are the cookieless page-view counts provided by our hosting provider, listed above. We run no advertising trackers and no session-recording tools.
Questions about any vendor on this list: privacy@sidebar-ai.com. See also our Data Practices page.