Sub-processor List
Version 6.3 · Effective 17 August 2026
Also published at app.lawcel.com, the canonical hosted version.
1. Introduction
Aslak Media ApS (CVR DK44604957), trading as Lawcel (Vesterbrogade 52a, 3250 Gilleleje, Denmark), uses the third parties listed below to process Personal Data on behalf of customers in connection with the Lawcel platform. This list forms part of our Data Processing Agreement (DPA) and constitutes the customer's prior general written authorisation under Article 28(2) GDPR.
Lawcel remains fully liable to customers for the acts and omissions of each sub-processor under Article 28(4) GDPR.
2. Current Sub-processors
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Anthropic, PBC | LLM reasoning for compliance analysis, document generation, and IDE-integration AI features | PR/issue metadata, code diffs, commit messages, legal document text, legal profile, IDE chat history | United States |
| Hetzner Online GmbH | Application, database, and storage hosting | All platform data at rest | Germany (EU) |
| Resend, Inc. | Transactional email (magic-link sign-in, team invites, notification emails) | Recipient email addresses, verification tokens, message content and delivery metadata | United States |
| Stripe, Inc. | Payment processing and subscription management (hosted Checkout, Customer Portal, webhook-based subscription state sync) | Organization identifier, Stripe customer ID, contact email address, subscription and payment metadata, payment card data and associated transaction metadata | United States |
| Geoapify GmbH | Address geocoding and autocomplete for the registered-address field in the legal-profile onboarding survey | Partial address strings entered by users during onboarding | Germany (EU) |
| Google LLC (Google Analytics 4) | Aggregated traffic measurement and funnel analytics on the public marketing site, loaded only after an analytics consent grant; the authenticated app is not tracked | Truncated IP address, device and browser technical data, marketing-site page URLs and titles, marketing funnel events (no PII) | United States |
Provider notes. Anthropic is engaged under its Commercial Terms and DPA; customer content submitted under the paid API tier is not used to train Anthropic's general models, subject to Anthropic's published terms. Hetzner provides bare infrastructure with no logical access to the application or database; Lawcel applies application-layer encryption. Resend processes only the email envelope and message content needed to deliver transactional mail, including sign-in, team-invite, and notification emails.
3. Notification of Changes
We notify customers of any new or replacing sub-processor at least 14 calendar days before processing begins, by:
- updating this page; and
- emailing each customer's designated privacy contact.
If a sub-processor must be replaced without delay to keep the Service secure and available (for example after a security incident or an abrupt provider failure), we may engage the replacement first and notify as soon as reasonably practicable, as set out in the DPA.
A customer may object on reasonable data-protection grounds within 14 calendar days of notification by writing to privacy@lawcel.com. If we cannot resolve the objection within 30 days, the customer may terminate the affected portion of the Service without penalty, as set out in the DPA.
Make sure your privacy contact in organisation settings is current to receive these notifications.
4. International Transfers
Anthropic, Resend, Stripe, Inc., and Google LLC are established in the United States. Transfers to them rely on the EU Standard Contractual Clauses (Module Two, Commission Decision 2021/914), incorporated in our DPA and the relevant sub-processor agreements. For UK transfers, the UK International Data Transfer Addendum applies in addition.
Lawcel has conducted a Transfer Impact Assessment for each US sub-processor in line with the Schrems II ruling (Case C-311/18) and EDPB Recommendations 01/2020, and concluded — taking into account the volume and category of data transferred and the technical and contractual safeguards applied — that the level of protection is essentially equivalent to that within the EEA. We will reassess if the legal landscape changes materially.
5. Due Diligence
Before engaging a sub-processor we review its public security and privacy posture, confirm it will accept Article 28(4) GDPR-equivalent contract terms, assess the geographic location and required transfer mechanism, and document the processing purpose and data categories. Sub-processor relationships are reviewed periodically and on material change.
6. Contact
privacy@lawcel.com — questions, change-notification subscriptions, sub-processor objections.
See also the Data Processing Agreement and Privacy Policy.