Legal
Subprocessors
Last updated · July 22, 2026
Version 1.0 · July 2026. This list is derived from an audit of the codebase, and it is the list the Data Processing Agreement incorporates by reference. It is split in two because the distinction matters: subprocessors are services Norma engages to operate the Service; customer-connected services are systems your firm authorizes through its own credentials, where your firm controls the connection and can revoke it. We update this page before adding or replacing a subprocessor, with notice as the DPA describes.
1. Subprocessors
Services processing data on Norma's behalf, on Norma's own credentials:
| Service | Purpose | Data touched | Location |
|---|---|---|---|
| Railway | Hosting and database infrastructure for the application, the API, and the marketing site | All Customer Data at rest: workspace records, uploaded files, encrypted integration credentials | United States |
| Anthropic | AI provider: Ask Norma answers, analysis narration, reply classification, document drafting | Task-scoped workspace context per request: the question, audited figures, contract excerpts | United States |
| OpenAI | AI provider: contract extraction and risk evaluation, structured extraction and classification | Uploaded contract text, clause excerpts and contract metadata, task-scoped inputs | United States |
| Resend | Transactional email: workspace invitations, password resets, operator notifications | Recipient email addresses and message content, including request-access form submissions | United States |
| Loops | Marketing email signup management, marketing site only | Signup email and the request-access form fields for users who submit them; no workspace data | United States |
| Plausible | Website analytics, marketing site only, cookieless | Aggregate pageview analytics; no cookies, no persistent identifiers, no workspace data | European Union |
| Tavily | Web search during firm-discovery onboarding | Search queries built from the firm name and website a prospective user provides; no workspace data | United States |
| Have I Been Pwned | Breached-password check when a password is set or reset | A 5-character SHA-1 hash prefix only, never the password and never the email | Global edge (Cloudflare) |
Document rendering (DOCX to PDF for invoices, statements, and reports) runs on Norma's own infrastructure inside the hosting environment. The document bytes never leave it, so no rendering vendor appears above.
During firm-discovery onboarding, Norma's server also fetches publicly available web pages directly, a plain read of the firm's own public site to supplement what search returns. It is a GET request only; no customer data is transmitted.
One client-side note for completeness: the marketing site and rendered fee-memo documents load fonts from Google Fonts, so a reader's browser contacts Google when those pages render. No workspace data is involved.
2. Customer-connected services
Systems your firm connects on its own credentials. These are not subprocessors: your firm authorizes each connection, the credentials are yours, and revoking them severs the flow.
| Service | Connection | What flows through it |
|---|---|---|
| Intuit QuickBooks Online | Per-workspace OAuth the firm authorizes; tokens stored encrypted | Norma reads the ledger, receivables, invoices, and reports. The one write is the invoice push a person confirms on each invoice. |
| Google Workspace / Gmail | Per-user OAuth the person authorizes; tokens stored encrypted | Norma creates drafts in the user’s own Drafts folder for a person to send, and reads replies on Norma-originated threads so a person can confirm their classification. Where a firm enables it, one internal reminder to a firm colleague sends after a person approves it. |
| Airtable | Per-workspace API token the firm supplies | Read-only sync of the firm’s own base into the workspace. Norma never writes to Airtable. |
3. Questions
How these services are used is described in the AI use statement and the Privacy Policy. Questions about this list: hello@norma-adi.com.