Este documento está disponible solo en inglés, y la versión en inglés es el texto vigente.
Subprocessors
Effective date: September 2, 2026
Last updated: September 10, 2026
Esqase, Inc. ("Esqase," "we," "us," or "our") uses a small number of third-party providers to operate the Esqase platform and services (the "Service"). This page lists them. It supplements Section 6 (Subprocessors) of our Data Processing Agreement and Section 5 (How We Share Your Information) of our Privacy Policy, and capitalized terms not defined here have the meanings given in our Terms of Service. Where the Data Processing Agreement refers to Esqase's current Subprocessors, it refers to this page, which forms part of that agreement.
1. What a Subprocessor Is
A Subprocessor is a third party that Esqase engages to process Personal Data on behalf of a Firm as part of delivering the Service. Under the Data Processing Agreement, the Firm is the Controller of that Personal Data, Esqase is the Processor, and each Subprocessor is bound by a written agreement imposing data protection obligations at least as protective as those Esqase owes the Firm. Esqase remains fully liable to the Firm for the performance of each Subprocessor's data protection obligations.
Section 3 lists the Subprocessors that may process Client Data. Section 4 lists the vendors that process information for which Esqase is itself the controller, such as account registration, Subscription billing, and website analytics. Those vendors are not Subprocessors under the Data Processing Agreement, and they are listed here so that this page gives a complete picture of who touches data connected to your use of Esqase.
2. Where Data Is Processed
Esqase runs its infrastructure on Google Cloud in the United States, and all of the providers below process data in the United States unless a row says otherwise. Cross-border transfers are handled as described in Section 10 (International Data Transfers) of the Data Processing Agreement and Section 10 of the Privacy Policy.
3. Subprocessors for Client Data
| Subprocessor | Purpose | Location |
|---|---|---|
| Google LLC (Google Cloud) | Cloud infrastructure: the application runtime (Cloud Run), the background job runtime (Cloud Functions), the database (Cloud SQL for PostgreSQL), file storage (Cloud Storage), the secret store (Secret Manager), the network perimeter every request passes through (Cloud Load Balancing, Cloud Armor, and Cloud CDN, which caches static assets only and never an authenticated response), and the log store (Cloud Logging). Firebase Data Connect is not used at all, and Firebase App Hosting serves only the public marketing and documentation website at esqase.com, which holds no Client Data | United States |
| Google LLC (Firebase) | Sign-in (Identity Platform); the real-time signals that tell an open page that something it is showing has changed, which are identifiers and timestamps and carry no record content (Firestore); push notification delivery, which carries no record content for a Firm that has accepted a Business Associate Agreement or a country data processing agreement (Firebase Cloud Messaging); and verification that a request comes from a genuine Esqase application (App Check) | United States |
| Google LLC (Vertex AI) | Artificial intelligence models used for search indexing and document descriptions, as described in Section 2.5 of the Data Processing Agreement | Document indexing and search embeddings both follow the country recorded in a Firm's settings: Google's European region for Firms in the EEA and the UK, Google's Australian region for Firms in Australia and New Zealand, and the United States for every other Firm. A Firm's records themselves are stored in the United States |
| Google LLC (reCAPTCHA Enterprise, through Firebase App Check) | Bot and abuse protection on Esqase applications and on the public pages a Firm shares with its clients, when enabled for an environment by Esqase | United States |
| Cloudflare, Inc. | Name resolution for Esqase's domains, and delivery of and protection for the marketing website at esqase.com, as described in Section 7.3 of the Cookie Policy. Cloudflare does not route or cache the traffic of the Esqase applications, which reaches Google Cloud's load balancer directly | United States, on a global network |
| Resend, Inc. | Transactional email delivery, including messages Esqase sends to a Firm's clients on the Firm's behalf, such as shared document invitations, invoice reminders, payment receipts, and sign-in links | United States |
| Google LLC (Gmail, Google Calendar, Google Meet APIs) | Email, calendar, and meeting integration, when enabled by an individual Authorized User | United States |
| Microsoft Corporation (Outlook, Outlook Calendar, Microsoft Teams APIs) | Email, calendar, and meeting integration, when enabled by an individual Authorized User | United States |
| Zoom Communications, Inc. | Meeting link integration, when enabled by an individual Authorized User | United States |
| PostHog, Inc. | Product analytics. Receives the Firm's name, the name and email address of the Authorized User signing in, the record identifiers of the records that user acts on, and technical data such as IP address, device, and browser; does not receive matter titles, client or contact names, document names or contents, message text, search terms, form answers, or any amount | United States |
Rows marked "when enabled by an individual Authorized User" describe optional integrations. They process data only after a Firm Owner or an individual Authorized User connects the service, and disconnecting it revokes Esqase's access. See Section 10 (Third-Party Integrations) of the Terms of Service.
AI document indexing reads the contents of documents in a Firm's account to build a description and a search index. A Firm Owner can turn it off for the whole Firm in Settings. See Section 5.8 of the Terms of Service.
Esqase does not process client card or wallet payments, so no card payment processor receives Client Data on a Firm's behalf. See Section 8.3 of the Terms of Service.
4. Vendors for Data Esqase Controls
| Vendor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Subscription billing and payment records for Esqase Subscriptions | United States |
| Resend, Inc. | Account, billing, security, and marketing email | United States |
| PostHog, Inc. | Product and marketing analytics for esqase.com and the Service | United States |
PostHog is the only analytics provider Esqase uses. Analytics providers never process the content of client matters or documents. What they receive, and what we deliberately do not send them, is described in Section 3.4 of the Privacy Policy and in our Cookie Policy.
5. Changes to This List, and Your Right to Object
We give at least 14 days' prior written notice by email before adding or replacing a Subprocessor that will process Personal Data, as provided in Section 6.3 of the Data Processing Agreement.
To receive email notice whenever this list changes, write to legal@esqase.com with the subject line "Subprocessor notifications" and tell us which address to use. You can unsubscribe from those notices at any time by replying to any of them.
If your Firm has a reasonable objection to a new Subprocessor relating to the protection of Personal Data, notify us at legal@esqase.com with the subject line "Subprocessor objection" within 14 days of the notice, with the grounds for the objection. We will work with you in good faith to resolve it. If it cannot be resolved, your Firm may terminate the affected portion of the Service as provided in the Data Processing Agreement.
6. Contact
For questions about this page or about our Subprocessors, contact:
Esqase, Inc.
Attention: Data Protection Team
2810 N Church St STE 89268
Wilmington, DE 19802, United States
legal@esqase.com