Data processing addendum
Processor terms for paid Casey workspaces.
Casey processes witness and matter data as a processor for the instructing firm. This page is a working draft for solicitor review and is not a substitute for a signed DPA.
Roles
The firm is the controller. Casey is the processor. Witnesses interact only through the firm's instructions and scoped intake links.
International transfers
Subprocessors may process data in the UK, EEA, or United States. Standard contractual clauses or equivalent safeguards apply where a restricted transfer is required.
Deletion
After an organisation is archived, Casey permanently deletes the tenant record when the organisation's retention period expires. Live matters are not auto-purged.
Schedule
Categories, subprocessors, and processor duties
Have your solicitor confirm this schedule before Casey marks a DPA as signed on the organisation.
Data categories
Witness identity, contact details, and interview transcripts
Case metadata, statement drafts, exhibits, and signed documents
Firm user accounts, roles, audit logs, and signature certificates
Subprocessors
Supabase — authentication, PostgreSQL, object storage
Cloudflare Workers — application hosting and scheduled jobs
Resend — transactional email
OpenRouter — model inference for interview, formalization, and analysis
Stripe — seat subscription invoicing
Self-hosted DocuSeal — certified electronic signature when enabled
Processor duties
Process personal data only on the firm's documented instructions
Apply technical and organisational measures described on the security page
Assist with subject access, deletion, and retention after archive
Delete or return tenant data when a soft-deleted organisation reaches its purge date