AI Sub-Processors
ChronoLaw engages the third-party sub-processors listed below to provide the services described in our Privacy Policy. When a BAA is in effect, subprocessors that create, receive, maintain, or transmit PHI or ePHI on our behalf are engaged under written agreements that satisfy 45 C.F.R. § 164.314(a). This page is intended to help attorneys assess data handling for privilege analysis, HIPAA review, and client disclosure purposes.
Effective date: May 15, 2026
| Provider | Purpose | Data Processed | Location | Data Terms |
|---|---|---|---|---|
| Anthropic, PBC (via Amazon Bedrock) | AI inference — Anthropic Claude Sonnet 4.6 for final chronology generation; Claude Haiku 4.5 for Q&A synthesis and document analysis | Document text and case context sent to models through private AWS Bedrock API channels. No content is used to train models under the applicable enterprise Bedrock terms. | United States (via Amazon Bedrock, us-east-1) | Privacy/DPA |
| Amazon Web Services — Bedrock (Amazon Nova Lite) | AI inference — Amazon Nova Lite foundation model for chunk-level document summarization | Document text chunks are sent to the Nova Lite model via the AWS Bedrock invoke_model API to produce intermediate summaries. No content is used to train models under AWS enterprise terms. | United States (us-east-1) | Privacy/DPA |
| Cohere, Inc. (via Amazon Bedrock) | Document embeddings (Cohere Embed v4) and semantic reranking (Cohere Rerank 3.5) for Q&A retrieval | Document text chunks are sent to the Cohere Embed v4 model to produce 1,536-dimension numerical vector representations used for semantic search. Retrieved document excerpts are sent to Cohere Rerank 3.5 during Q&A queries to improve result relevance. All calls are made through private AWS Bedrock API channels. No content is used to train models under the applicable enterprise Bedrock terms. | United States (via Amazon Bedrock, us-east-1) | Privacy/DPA |
| Pinecone Systems, Inc. | Vector database — stores and retrieves document embeddings for semantic search | Numerical vector representations of document chunks produced by Cohere Embed v4 (1,536 dimensions, no human-readable text). Case-scoped namespaces. Index: litigation-documents-v2. | United States | Privacy/DPA |
| Amazon Web Services (AWS) | Cloud infrastructure, application hosting (ECS Fargate), relational database (RDS), object storage (S3), and networking | Uploaded documents, processed files, application data, and operational logs for services running in AWS. | United States (us-east-1) | Privacy/DPA |
| Amazon ElastiCache for Redis (AWS) | Task queue broker (Celery) and caching | Background job payloads, session data, and query caches. Data is transient and expires per configured TTLs. | United States (us-east-1) | Privacy/DPA |
| Vercel Inc. | Frontend hosting and CDN | Static assets, client-side application bundles, and edge request metadata. Case document content is not stored on Vercel. | United States | Privacy/DPA |
| Stripe, Inc. | Payment processing and subscription management | Billing information, payment card data (Stripe-hosted), and subscription metadata. | United States | Privacy/DPA |
| Resend, Inc. | Transactional email (confirmation emails, notifications, newsletter) | Recipient email addresses and email subject and body for system notifications. No case content is included. | United States | Privacy/DPA |
Attorney Notes
- All AI inference and embedding calls are routed through AWS Bedrock private API channels. No customer document text is transmitted to external provider endpoints outside of Bedrock's private infrastructure.
- Anthropic models (Claude Sonnet 4.6 and Claude Haiku 4.5) and Amazon Nova Lite are invoked through Amazon Bedrock under enterprise terms that prohibit use of submitted data for model training.
- Cohere Embed v4 and Cohere Rerank 3.5 are accessed exclusively through Amazon Bedrock under enterprise terms that prohibit use of submitted data for model training. Cohere does not receive API calls directly; all data flows through AWS Bedrock.
- Pinecone stores only numerical vector representations (embeddings produced by Cohere Embed v4) — no human-readable document text is transmitted to or stored in Pinecone.
- Backend application services, PostgreSQL, and ElastiCache run in a private AWS VPC in us-east-1. The web application is delivered through Vercel's US edge network.
- When a BAA is in effect, ChronoLaw requires written agreements with subprocessors that may process PHI or ePHI before those subprocessors create, receive, maintain, or transmit PHI or ePHI on our behalf. See Privacy Policy Section 6.4 and Terms of Use §11.D.
- For subprocessor agreements and HIPAA-related vendor documentation, contact legal@chrono-law.com.
For questions about specific data handling, contact privacy@chrono-law.com.