PRODUCT.md §10.10

Service Providers, Sub-processors, and Affiliates

Effective 16 September 2026. Binding long-form text is in PRODUCT.md. This page is the public copy.

Operator (Owlaw): host and support; tenant database; in product.

Vercel (optional): web front end; request logs; UI can publish, API needs a JVM.

PostgreSQL host (optional): all tenant rows; docker-compose / postgres profile; not the default.

PayFast Aggregation: plan and staff-seat subscriptions and phone-minute charges. Keys stay in the server environment. Sandbox until live KYC.

Twilio: PSTN, SMS, and WhatsApp metadata and caller ID when the firm connects it. Credentials stay in the server environment.

Authenticator apps: TOTP; shared secret stays on the user row.

OpenAI or Anthropic (optional): model answers for one matter; off unless LEGALSUITE_AI_PROVIDER and a key are set.

Affiliates: none listed. Firms may not treat a demo “connected” integration as a live subprocessor until keys are real.
Owlaw