AI Sub-Processors
ChronoLaw engages the third-party vendors listed below to provide the services described in our Privacy Policy. This page is intended to help attorneys assess data handling for privilege analysis, HIPAA review, and client disclosure purposes.
When a BAA is in effect, subprocessors that create, receive, maintain, or transmit PHI or ePHI on our behalf (the first table) are engaged under written agreements that satisfy 45 C.F.R. § 164.314(a). Legal research vendors in the second table receive only de-identified Safe Harbor queries and are not PHI subprocessors for that path.
Effective date: August 19, 2026
| Provider | Purpose | Data Processed | Location | Data Terms |
|---|---|---|---|---|
| Anthropic, PBC (via Amazon Bedrock) | AI inference — Anthropic Claude Sonnet 4.6 for final chronology generation; Claude Haiku 4.5 for Q&A synthesis and document analysis | Document text and case context sent to models through private AWS Bedrock API channels. No content is used to train models under the applicable enterprise Bedrock terms. | United States (via Amazon Bedrock, us-east-1) | Privacy/DPA |
| Amazon Web Services — Bedrock (Amazon Nova Lite) | AI inference — Amazon Nova Lite foundation model for chunk-level document summarization | Document text chunks are sent to the Nova Lite model via the AWS Bedrock invoke_model API to produce intermediate summaries. No content is used to train models under AWS enterprise terms. | United States (us-east-1) | Privacy/DPA |
| Cohere, Inc. (via Amazon Bedrock) | Document embeddings (Cohere Embed v4) and semantic reranking (Cohere Rerank 3.5) for Q&A retrieval | Document text chunks are sent to the Cohere Embed v4 model to produce 1,536-dimension numerical vector representations used for semantic search. Retrieved document excerpts are sent to Cohere Rerank 3.5 during Q&A queries to improve result relevance. All calls are made through private AWS Bedrock API channels. No content is used to train models under the applicable enterprise Bedrock terms. | United States (via Amazon Bedrock, us-east-1) | Privacy/DPA |
| Pinecone Systems, Inc. | Vector database — stores and retrieves document embeddings for semantic search | Numerical vector representations of document chunks produced by Cohere Embed v4 (1,536 dimensions, no human-readable text). Case-scoped namespaces. Index: litigation-documents-v2. | United States | Privacy/DPA |
| Amazon Web Services (AWS) | Cloud infrastructure, application hosting (ECS Fargate), relational database (RDS), object storage (S3), and networking | Uploaded documents, processed files, application data, and operational logs for services running in AWS. | United States (us-east-1) | Privacy/DPA |
| Amazon ElastiCache for Redis (AWS) | Task queue broker (Celery) and caching | Background job payloads, session data, and query caches. Data is transient and expires per configured TTLs. | United States (us-east-1) | Privacy/DPA |
| Vercel Inc. | Frontend hosting and CDN | Static assets, client-side application bundles, and edge request metadata. Case document content is not stored on Vercel. | United States | Privacy/DPA |
| Stripe, Inc. | Payment processing and subscription management | Billing information, payment card data (Stripe-hosted), and subscription metadata. | United States | Privacy/DPA |
| Resend, Inc. | Transactional email (confirmation emails, notifications, newsletter) | Recipient email addresses and email subject and body for system notifications. No case content is included. | United States | Privacy/DPA |
Legal research (de-identified queries)
These vendors receive HIPAA Safe Harbor de-identified legal-research queries only. They are not PHI subprocessors for this path, and ChronoLaw holds the API credentials — users do not need Vaquill or CourtListener accounts.
| Provider | Purpose | Data Processed | Location | Data Terms |
|---|---|---|---|---|
| Vaquill AI (Aralsura Solutions LLP) | Statute retrieval for Legal Intelligence — search and fetch public statute section metadata and body text | De-identified statute search queries (jurisdiction and concept filters) and citation / section identifiers. Case document bodies and matter files are not uploaded. Queries are screened under HIPAA Safe Harbor (45 C.F.R. § 164.514) before they leave ChronoLaw. | United States | Privacy/DPA |
| Free Law Project (CourtListener) | Case-law opinion search for Legal Intelligence via the CourtListener REST API | De-identified opinion search queries (jurisdiction/court filters and abstracted issue language) and citation lookup. Case document bodies are not uploaded. Queries are screened under HIPAA Safe Harbor (45 C.F.R. § 164.514) before they leave ChronoLaw. | United States | Privacy/DPA |
Attorney Notes
- All AI inference and embedding calls are routed through AWS Bedrock private API channels. No customer document text is transmitted to external provider endpoints outside of Bedrock's private infrastructure.
- Anthropic models (Claude Sonnet 4.6 and Claude Haiku 4.5) and Amazon Nova Lite are invoked through Amazon Bedrock under enterprise terms that prohibit use of submitted data for model training.
- Cohere Embed v4 and Cohere Rerank 3.5 are accessed exclusively through Amazon Bedrock under enterprise terms that prohibit use of submitted data for model training. Cohere does not receive API calls directly; all data flows through AWS Bedrock.
- Pinecone stores only numerical vector representations (embeddings produced by Cohere Embed v4) — no human-readable document text is transmitted to or stored in Pinecone.
- Amazon Bedrock receives document text and case context for inference and embeddings. Vaquill and CourtListener receive only de-identified Safe Harbor queries for Legal Intelligence — not case document bodies or PHI.
- Vaquill is used only for public statute retrieval. CourtListener is used only for public opinion search. ChronoLaw holds the API keys; users never need separate research-vendor accounts.
- Backend application services, PostgreSQL, and ElastiCache run in a private AWS VPC in us-east-1. The web application is delivered through Vercel's US edge network.
- When a BAA is in effect, ChronoLaw requires written agreements with subprocessors that may process PHI or ePHI before those subprocessors create, receive, maintain, or transmit PHI or ePHI on our behalf. See Privacy Policy Section 6.4 and Terms of Use §11.D.
- For subprocessor agreements and HIPAA-related vendor documentation, contact legal@chrono-law.com.
For questions about specific data handling, contact privacy@chrono-law.com.