Clearly — Subprocessors
Version 1.0 — 2026-06-12 (draft for counsel review; publish at [clearly.app/legal/subprocessors])
This is the authoritative, public list of the subprocessors Clearly uses to provide the service, as authorized in DPA §4 and Annex B. Each is bound by a data processing agreement with obligations materially equivalent to ours; Clearly remains liable for their performance.
Where data lives: stored workspace data (transcripts, briefs, accounts) resides in the EU — Ireland (AWS eu-west-1). Application compute runs in Dublin (Vercel dub1); static assets are delivered globally. During a live meeting, audio streams to Deepgram (US) and transcript excerpts go to OpenAI (US) under the safeguards below. Meeting audio is never stored by anyone in this chain on Clearly's behalf, and no provider may use meeting content to train AI models.
Current subprocessors
| Subprocessor | Service | Data | Location | Transfer mechanism | Notes |
|---|---|---|---|---|---|
| Supabase Inc. | Database, authentication | All stored workspace data | EU — Ireland (AWS eu-west-1) | DPA; data at rest in the EU [verify DPF for US support access] | SOC 2 Type II; encryption at rest |
| Deepgram Inc. | Speech-to-text | Live audio stream (transient); returned transcript | USA | DPA; EU SCCs + Swiss addendum | SOC 2 Type II; model-improvement program opted out in every connection |
| OpenAI, L.L.C. | Transcript analysis, summaries | Transcript text, brief state, meeting context | USA [EU residency under evaluation] | DPA; [verify DPF] / SCCs + Swiss addendum | API data not used for training; ~30-day abuse retention |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments, subscriptions | Billing identity, transactions | EU/USA | Stripe DPA; [verify DPF] | Independent controller for parts of payment processing; card data never touches Clearly |
| Vercel Inc. | Hosting, delivery, cookieless analytics | Traffic, server logs | Compute: Dublin (dub1); static/edge delivery global | DPA; Swiss–U.S. & EU–U.S. DPF (certified) | |
| Microsoft Ireland Operations Ltd. / Microsoft Corp. | Calendar integration (only when a workspace connects it) | Calendar events, attendees | The customer's own M365 tenant | Microsoft DPA | Customer-initiated; read-only |
| Resend (Plus Five Five, Inc.) | Invitation emails (optional) | Invitee email address | USA | DPA; Swiss–U.S. & EU–U.S. DPF (certified) | Only active when configured |
How changes are announced
- We update this page and email all workspace owners at least 30 days before adding or replacing a subprocessor (security emergencies: as fast as possible, with prompt notice).
- Customers may object on reasonable data protection grounds (DPA §4.2). If no solution is found, the customer may terminate the affected service against a pro-rata refund of unused prepaid minutes.
- Every change is recorded in the changelog below — this page is the authoritative version history.
Changelog
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-06-12 | Initial published list. Storage region stated (EU — Ireland, AWS eu-west-1); compute pinned to Dublin (dub1); Deepgram model-improvement opt-out in force. |
Draft prepared for review by qualified Swiss counsel; bracketed items must be resolved before publication.