This document lists the third-party subprocessors that ContraForge LLC engages to provide the PaidWrite service. This list is referenced by our Data Processing Addendum and Privacy Policy.

Current Subprocessors

Subprocessor	Purpose	Data Processed	Location
Railway	Application compute (API, LiteLLM proxy, ingestion sidecar)	All application data in transit and during processing	USA
Neon, Inc.	Database hosting (PostgreSQL + pgvector)	Analysis results, device identifiers, credit balances, payment records; extracted document text (encrypted, only while an analysis runs)	USA (AWS us-west-2, Oregon)
Stripe, Inc.	Payment processing (Stripe Checkout)	Payment card information, transaction amounts, email addresses	USA
Google LLC (Gemini API)	Primary AI document analysis model, via LiteLLM	PII-masked document text (in transit, not stored per Google API terms)	USA
Groq, Inc.	Fallback AI inference provider	PII-masked document text (in transit, not stored)	USA
OpenRouter	Last-resort AI model routing (including Anthropic models as a fallback route)	PII-masked document text (in transit)	USA
Google LLC (Cloud Vision API) — optional, off by default	Server-side OCR from the document image, only when the cloud OCR driver is explicitly enabled by an operator	Document image (in transit, not stored)	USA
CloudAMQP	Hosted message queue for background analysis jobs	Job identifiers and device identifiers (no document text in queue payloads)	USA
Resend	Transactional email delivery (email-to-scan replies, receipts) and the waitlist audience	Email addresses, analysis result summaries	USA
Functional Software, Inc. (Sentry)	Error monitoring	Error logs, stack traces (no document content)	USA
Cloudflare, Inc.	Website hosting (Pages), waitlist worker and KV store, Turnstile bot protection, email routing for the scan@ inbox	Website visitor IP addresses, waitlist email addresses, inbound email envelopes and attachments (in transit)	USA / global edge
Google LLC (Analytics, Fonts)	Google Analytics 4 on the website (consent-gated) and Google Fonts	Website usage data (only after consent), IP address for font requests	USA

Important Notes

Document Text Processing

Document text is sent to AI providers (Google, Groq, OpenRouter) only during active analysis. Personally identifying information is masked in-process before transmission, text is transmitted via encrypted connections (TLS), and it is deleted by PaidWrite when the analysis finishes or fails. Each AI provider's data handling is governed by their respective API terms of service and data processing agreements.

AI Provider Data Residency

All AI inference providers used by PaidWrite (Google, Groq, OpenRouter) operate US-based infrastructure. Document text is not transmitted to any AI inference provider that processes data in the People's Republic of China.

Optional Server-Side OCR (Google Cloud Vision)

By default, server-side OCR runs locally (Tesseract) and no document image leaves PaidWrite's own infrastructure. An operator may optionally enable Google Cloud Vision for OCR (OCR_DRIVER=cloud_vision plus an explicit acknowledgment flag). When enabled, the raw document image is transmitted to Google Cloud Vision for text extraction (in transit only; not stored). This occurs before the in-process PII redaction, which operates on extracted text — so with the cloud driver enabled, the un-redacted image reaches Google. The driver is disabled by default and activates only after explicit operator acknowledgment.

Document Retention

The original document file is deleted within 30 seconds of upload. Extracted text is held encrypted only while the analysis runs (usually under a minute) and is deleted when it finishes or fails; an hourly sweep scrubs any stale row. Only structured analysis results (risk level, compliance summaries, document type) are persisted. No subprocessor stores original documents on PaidWrite's behalf. (The one case a document image is transmitted to a third party is the optional Cloud Vision OCR driver above — transient extraction, not storage.)

Change Notification Process

ContraForge will provide 30 days' advance written notice before engaging a new subprocessor or materially changing the scope of an existing subprocessor's processing activities. Notice will be:

Posted as an update to this document
Emailed to all clients with an active Data Processing Addendum

Right to Object

Clients with an active Data Processing Addendum may object to a new subprocessor within 15 days of receiving notice. If ContraForge cannot reasonably accommodate the objection, the client may terminate the affected services. See the Data Processing Addendum for full details.

Contact

Email: privacy@paidwrite.app Enterprise inquiries: sales@paidwrite.app