Subprocessors

Provides account authentication, database storage, and private file storage.

May process account information, custody records, uploaded files, and information needed to operate those services.

Processing location depends on the configured project region and Supabase's authorized infrastructure and subprocessors.

Hosts the Custody Folio application server.

May process web traffic and limited operational information needed to provide hosting.

Provides encrypted, access-restricted off-site backup storage for private evidence files because Supabase database backups do not include Storage objects.

May process encrypted backup copies of uploaded evidence and the minimum object metadata required for recovery. Compliance retention prevents alteration or early deletion and expires no later than 180 days after the applicable backup.

Provides website traffic protection, DNS, and domain services.

May process IP addresses, web request information, and security events.

Provides the Custody Folio support, privacy, and security mailboxes.

May process the sender address, message content, attachments, and delivery information when someone contacts those mailboxes.

Delivers one-time sign-in codes, account confirmations, invitations, and security-related email on behalf of Supabase Auth.

May process the recipient email address, message content, delivery status, IP and device information used for email delivery and abuse prevention. Custody record contents are not intentionally included.

Provides hosted web checkout, recurring subscriptions, invoices, payment-method management, refunds, disputes, and the Customer Portal when web billing is enabled.

May process account email, provider customer and subscription identifiers, payment details, billing or U.S. service address, transaction information, and fraud-prevention signals. Custody Folio does not receive or store full card numbers.

Custody-record contents, evidence files, case labels, and child information are not sent to Stripe.

Provides in-app subscription purchase, renewal, cancellation, refund, and transaction-status services when App Store billing is enabled.

May process Apple account, device, storefront, purchase, subscription, refund, and payment information. Custody Folio receives signed transaction and status information tied to a random app-account token.

Custody-record contents, evidence files, case labels, and child information are not sent to Apple for billing. Apple processing is not required for a Stripe web subscription.

Custody Folio uses its protected production hosting and logging environment to retain minimized application and security events. A separate SIEM or security-event webhook will be identified here before it receives production events.

Security events may contain request route, time, status, request identifier, and shortened hashes of IP address, user agent, account ID, or case ID. They are designed not to contain record or file contents.

We require service providers to protect personal information and use it only to provide their services to Custody Folio.

We review providers for access controls, encryption, retention, deletion, incident notice, and their own subprocessors in proportion to the sensitivity of the information they receive.

We will update this page and provide notice when required before a material new provider begins processing customer records for a new purpose.