Subprocessors
Every external party in the IP path — and what it touches.
The complete list of third parties Sparlo relies on for the patent product, what each one does, and precisely what customer data it receives — stated per the per-job egress model, specifically enough for a security committee to verify. For the full confidentiality architecture, see the security section.
In the analysis path
These parties may receive data while a job runs. What actually leaves the trust boundary differs by job: draft and review jobs make zero external calls; office-action jobs send only public patent numbers; patentability and moat jobs send only generalized terms. Your source documents are never sent to a search provider.
Anthropic (Claude API)
United States (Anthropic API)AI inference — the reasoning engine behind every analysis.
- Data touched
- Your document text and prompts. No training on customer content (Anthropic Commercial Terms); API inputs and outputs deleted within ~30 days (Zero Data Retention in progress). Called directly — no resold marketplace, no failover. Holds SOC 2 Type II, ISO/IEC 27001:2022, and ISO/IEC 42001:2023.
Supabase
United States (US-West)Database, file storage, and authentication host.
- Data touched
- Your documents, analyses, uploads, and account/auth data — at rest. AES-256 encryption at rest; Row-Level Security tenant isolation enforced at the database layer, not in application code.
Railway
United StatesApplication hosting and compute.
- Data touched
- Request and response held in memory during processing only. TLS in transit; no persistent storage of your content.
Inngest
United StatesBackground job orchestration.
- Data touched
- Record identifiers only, inside application-layer-encrypted payloads. Your document text never enters the queue or its logs.
SerpAPI (Google Patents engine)
United StatesPatent reference and prior-art retrieval — fallback and non-US references.
- Data touched
- Public patent numbers (Respond to an Office Action) or generalized invention terms (Patentability & Moat) — never your disclosure or draft. US patent text is fetched from the USPTO’s own public API first (see the public authority below); SerpAPI is the fallback and the path for non-US references. Moat queries pass a §102 novel-element deny-set gate before anything leaves.
Exa
United StatesTechnical-literature search.
- Data touched
- Generalized invention terms only, and only for Patentability & Moat — never your disclosure. Zero-data-retention tier.
Public authority queried
US patent text is retrieved from the U.S. government’s own public API first — an authoritative public-record source, not a commercial subprocessor. It receives only public patent numbers.
USPTO Open Data Portal (api.uspto.gov)
United States (U.S. government)Authoritative US patent full text — the primary source for US references.
- Data touched
- Public US patent numbers only — never your disclosure, draft, or any confidential content. A U.S. government public-record source; the numbers sent are already on the public record, and it returns the patent’s own published claims and text.
Operational infrastructure
Platform services that keep the product running and secure. None of these receive your report or document content — they touch account metadata, notifications, error diagnostics, and usage events only.
Transactional email (Resend / SMTP)
United StatesAccount and notification emails.
- Data touched
- Recipient email address plus notification and status text and links (for example, “your report is ready,” invitations, and billing notices). Never your report or document content.
Sentry
United StatesError monitoring.
- Data touched
- Exception messages and stack traces used to diagnose faults. Configured so your report and document content are not captured.
PostHog
United StatesProduct and marketing analytics.
- Data touched
- Usage and behavioral events such as page views and feature usage. Not your report or document content.
Disabled and never called: general web-search providers (Perplexity, Tavily) exist in the platform but are turned off for every IP job — the query bucket is left empty in code, so they are never reached. Location fields reflect each provider’s primary U.S. infrastructure used by the product; exact data-residency terms are in each provider’s own DPA, available on request.
When this list changes
Before we add or replace any subprocessor that will process your content, we give at least 30 days’ advance notice — by email to your account owner(s) and by updating this page. During the notice period you may object in writing on reasonable data-protection grounds; we will work with you to resolve it, and if we cannot, you may suspend or terminate the affected part of the service without penalty. This commitment is written into our Data Processing Addendum.
Questions or a DPA request?
We answer diligence questions in writing and can provide a signable Data Processing Addendum (no-training clause, 72-hour breach notification, deletion on termination). Reach us at security@sparloip.com.
Sources your reviewer can verify: Anthropic Commercial Terms of Service and certifications (trust.anthropic.com) · ABA Formal Opinion 512 (July 2024) · USPTO, Guidance on Use of AI-Based Tools in Practice, 89 FR 25609 (April 2024).