AIDAN LLC d/b/a Legasus uses third-party providers to help deliver, secure, support, and operate the Services. This page identifies providers that may Process Customer Data on Legasus's behalf depending on the features, integrations, plan, and configuration Customer uses.
Not every provider below receives every Customer's data. Optional integrations and features may cause data to be sent only when Customer enables or uses them.
Current Subprocessors / Service Providers
| Provider | Primary purpose | Customer Data potentially processed | Typical processing location | Optional / feature-dependent | PHI note |
|---|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, compute, storage, networking, backup, security services | Customer Data hosted or processed in covered infrastructure | Primarily United States unless otherwise configured | Core infrastructure | PHI only through services/configurations approved by Legasus for HIPAA-eligible use and subject to required contractual safeguards |
| OpenAI | AI model inference / AI-enabled functionality | AI Inputs, prompts, context, documents or Customer Data necessary for enabled AI features; AI Outputs | United States and/or provider-supported regions under applicable enterprise/API configuration | Feature-dependent | PHI only if Legasus expressly designates the applicable configuration HIPAA-eligible and all required HIPAA arrangements are in place |
| Anthropic | AI model inference / AI-enabled functionality | AI Inputs, prompts, context, documents or Customer Data necessary for enabled AI features; AI Outputs | United States and/or provider-supported regions under applicable commercial/API configuration | Feature-dependent | PHI only if expressly designated HIPAA-eligible and required arrangements are in place |
| Stripe | Payment processing, billing, subscription transactions | Billing contact information, transaction metadata, payment-related information; generally not substantive legal matter content | Provider-supported regions | Used for applicable billing flows | Not intended for matter PHI |
| Cloudflare | Content delivery, network/security protection, DNS, traffic protection and related edge services | Network metadata; request information; content in transit to the extent technically processed by enabled services | Global network, with processing based on configuration | Infrastructure/security | PHI handling depends on exact service/configuration and must be approved for HIPAA-eligible use before PHI is routed through it |
| DocuSign | Electronic signature workflows | Documents, signer information, signature metadata and Customer-selected content sent for signature | Provider-supported regions | Optional | PHI only where Customer/Legasus use an approved HIPAA-eligible configuration and required agreements apply |
| Google Workspace integrations and related authorized services | Email, calendar, file metadata/content, account information or other Customer-selected data within authorized scopes | Provider-supported regions | Optional integration | PHI eligibility depends on the exact Google service and Customer/Legasus configuration; not automatically HIPAA-eligible | |
| Microsoft | Microsoft 365 integrations and related authorized services | Email, calendar, file metadata/content, account information or other Customer-selected data within authorized scopes | Provider-supported regions | Optional integration | PHI eligibility depends on the exact Microsoft service and configuration; not automatically HIPAA-eligible |
| Sentry | Application error monitoring, diagnostics, reliability and issue investigation | Technical logs, error information, identifiers, request metadata, and limited contextual data where necessary for debugging | Provider-supported regions | Core/operational | Legasus should configure data minimization; PHI should not be intentionally sent unless the exact configuration is approved for HIPAA-eligible use |
| ElevenLabs | Voice AI, speech synthesis, speech processing and related voice functionality | Audio, text, transcripts, prompts, voice-related Customer Data required for enabled feature | Provider-supported regions | Optional voice feature | PHI only if Legasus expressly approves the applicable service/configuration for HIPAA use and required contractual safeguards are in place |
| Auth0 | Authentication, identity, access management | User identity, login/account metadata, authentication events, identifiers | Provider-supported regions | Core authentication | Not intended for substantive matter PHI; account information may be sensitive |
| LexisNexis | Licensed legal research, content, citations and research functionality | Research queries, search context and Customer-selected information necessary to perform enabled legal research | Provider-supported regions | Feature/plan-dependent | PHI should be minimized and sent only where permitted by applicable license/configuration and HIPAA requirements |
AI Provider Data-Use Position
Where Legasus uses third-party AI providers to provide AI-Enabled Features, Legasus uses business, enterprise, or API arrangements intended to prevent Customer Data submitted through Legasus from being used to train the provider's generalized models, subject to the applicable provider terms and any separately disclosed optional-feature conditions.
Legasus does not use Customer Data to train generalized/shared Legasus models for unrelated Customers unless Customer separately and expressly agrees in writing.
Private AI
Customers with a separately approved Private AI Configuration may have different data flows and may avoid third-party foundation-model inference for the workloads identified in the applicable Order Form or technical configuration.
HIPAA
The presence of a provider on this list does not mean the provider or every service it offers is approved for PHI.
Legasus designates specific Services/configurations as HIPAA-eligible and will use a subprocessor for PHI only where Legasus has determined that the relevant service/configuration and contractual relationship are appropriate for HIPAA-regulated Processing.
New and Replacement Subprocessors
Legasus may add or replace Subprocessors as the Services evolve. Notice and objection rights, where required by applicable Data Protection Law, are governed by the Legasus Data Processing Addendum.
Customers should monitor this page or use any available subprocessor-update notification mechanism.
Questions
Privacy / subprocessors: privacy@legasus.ai
Security: security@legasus.ai