Every third party that receives personal data from Askhive, and the 30-day change notice.
Every third party that receives personal data from Askhive. This page is authoritative — if a company is not on it, it does not receive your data. Each entry was confirmed against the outbound calls the code actually makes.
| Company | What they do for us | What they receive | Where |
|---|---|---|---|
| Supabase, Inc. | Database, authentication, file storage, and the server functions that run the productThe primary store. Everything else in this list receives a subset of what Supabase holds. | Account email, questions and reports, Practice client records and attachments, usage counters | United States (AWS us-east-1, Northern Virginia) |
| Anthropic, PBC | The language model that reads a question and drafts the reportPractice briefs are redacted before they are sent: identifiers are replaced with tokens and restored afterwards, so the model receives [SSN_1] rather than the number. | The question text, any attached file, and the clarifying answers — sent per request, not stored by us there | United States |
| Anthropic, PBC — web search | Research for a Deep Dive: the model's own web search, used to find and cite sources Used only for the Deep Dive and the Research memo, not yet available. | Search queries built from the report's topic. They carry no name, account number or other identifier, and the person's own documents are never sent to search. | United States |
| OpenAI, L.L.C. | Concept images for a Deep Dive — the illustrations captioned as AI-generated Used only for the Deep Dive and the Research memo, not yet available.Chosen on provenance rather than price: the images come back carrying C2PA metadata saying they were machine-made, and the bytes are stored unmodified so that mark survives. | A written description of the picture to draw, composed from the report's topic. No personal data, no attachments, and no part of a Practice client's record. | United States |
| Vercel, Inc. | Hosting for askhive.app, the shared-report pages, the Practice web app, and uptime monitoring | Request metadata (IP address, user agent) in ordinary web logs; the content of a shared report as it is served | United States |
| Stripe, Inc. | Subscription billing for Askhive PracticeCard details go to Stripe directly and never reach our servers. We store only Stripe's identifiers. | Billing name and email, payment method, subscription state | United States |
| Twilio Inc. (Verify) | Would deliver six-digit sign-in and consent codes by text message, only to a person who has given their number and consent (notification settings, PD8) Not yet in use — may be used from October 29, 2026, when the thirty days' notice given on naming it ends. | The phone number, the code, and delivery metadata. Never a name, never a report. | United States |
| Deepgram, Inc. | Would transcribe a professional's dictated brief or a client's voice note into text, per request Not yet in use — may be used from October 29, 2026, when the thirty days' notice given on naming it ends. | The audio clip and its transcript, per request, with the vendor's no-retention option set. Nothing stored there. | United States |
| Voyage AI Innovations Inc. | Would turn report and client-record text into embeddings for search by meaning across a firm's own workspace; the index itself would live in Askhive's own database Not yet in use — may be used from October 29, 2026, when the thirty days' notice given on naming it ends. | The text of a report or a client record, sent once to embed and not stored by the vendor. | United States |
| Cloudmersive, LLC (Virus Scan API) | Would scan a client's uploaded file for malware before the firm can open it Not yet in use — may be used from October 30, 2026, when the thirty days' notice given on naming it ends. | The uploaded file, sent once to scan and not stored by the vendor; the verdict | United States |
| Resend (Plus Five Five, Inc.) | Transactional email — delivered reports, refinement notifications, account mail | Recipient email address and the message content | United States |
There is no analytics or advertising provider anywhere in Askhive. No Google Analytics, no Facebook SDK, no PostHog, no Mixpanel, no Segment, no ad network. Usage measurement is first-party and goes to our own database. There is also no error-reporting service: crashes are not sent anywhere.
We give 30 days' notice before adding or replacing a sub-processor. Practice firms are notified by email at the workspace address and may object under §5 of the Data Processing Agreement. Changes are posted here with the date.
To be told by email when this page changes, write to privacy@bridgeshorelabs.com.