Privacy and data processing

Service providers

Disclosure updated October 14, 2026

This schedule identifies services used for TruLexa product hosting and processing, account authentication, subscription administration, service email and payments. Each row identifies that provider’s own function and information. Optional public-website measurement is disclosed separately in section 6 of the Privacy Policy; it is not a provider of TruLexa matter processing.

TruLexa operates proprietary AI models on infrastructure controlled by AIstrova Technologies Inc. Approved external AI providers support specific configured workflows. Their inclusion in this schedule does not mean that they operate all TruLexa models or process every request.

AIstrova remains responsible for personal information processed on its behalf. Providers may process information only for their stated service functions under written contracts or equivalent privacy and security terms.

The labels describe functions, not shared access. A provider may receive only the information specified in its own row for that function. An entry does not authorize another listed provider to receive that information. Whether a provider is a subprocessor depends on its actual processing role and any law or customer data-processing agreement applicable to that role. These labels do not change its permitted information or purposes.

Amazon Web Services (AWS)

Product services
Role and service
Cloud and application hosting, logging and security monitoring, and AI-service infrastructure where used.
Location or configuration
AWS Canada (Central) Region / Montréal configuration for core product infrastructure.
Customer information involved
Account data, technical diagnostics and security information, and transient product data as the requested workflow requires.
Outside this function
This hosting role does not authorize advertising, model training or a retained archive of completed matter content.

Google — Gemini Enterprise Agent Platform

Product services
Role and service
External AI-model processing through Gemini Enterprise Agent Platform for TruLexa workflows configured to use it. AIstrova-operated model processing is separate.
Location or configuration
Montréal configuration for Gemini Enterprise Agent Platform processing where used.
Customer information involved
Transient prompts, selected context, documents, uploads, and generated workflow outputs as needed for the requested workflow.
Outside this function
This workflow role does not authorize access to the Company’s account or billing databases, stored payment credentials, unrelated matter history or model-training use.

Supabase

Product services
Role and service
Account authentication, identity and subscription administration.
Location or configuration
Canada Central configuration.
Customer information involved
Account and profile information, authentication metadata, and subscription-administration records such as plan, status, trial and billing-period dates, seat counts and subscription identifiers. No payment-card credentials or matter content.
Outside this function
Matter prompts, selected documents, uploaded matter files and generated legal work.

Microsoft Graph API

Ancillary
Role and service
Transactional email and service communications.
Location or configuration
Processing follows the applicable Microsoft service configuration and terms.
Customer information involved
Limited account, contact, and service-communication information. It is not used for confidential matter-content processing.
Outside this function
Matter prompts, selected documents, uploaded matter files and generated legal work. Customers should not place confidential matter content in service-email messages.

Stripe

Ancillary
Role and service
Billing and payment communications and payment processing.
Location or configuration
Processing follows the applicable Stripe service configuration and terms.
Customer information involved
Billing contact information, payment metadata, and transaction information. It is not used for confidential matter-content processing.
Outside this function
Matter prompts, selected documents, uploaded matter files and generated legal work.

Processing boundaries

  • AWS may process the hosting data identified in its row. Google’s Gemini Enterprise Agent Platform may process transient matter content only for a workflow configured to use it. Supabase’s account, authentication and subscription-administration function does not give it permission to receive matter prompts, documents or generated work.
  • Microsoft Graph receives the account/contact information and service-email content required for transactional communications. Stripe receives billing contacts, payment and transaction information for payments. Neither function includes processing confidential matter content.
  • No entry authorizes AI-model training, advertising, resale or unrelated use of client submissions. Optional public-website measurement is separate from these product, account, email and payment functions.
  • Google Picker and Google Drive are optional connected-account integrations for selecting and importing files you authorize. They are separate from Gemini AI processing and do not grant TruLexa unrestricted access to your Google Drive.

Provider changes

AIstrova maintains this schedule and updates it when its current providers change. Material changes affecting customer information are addressed through applicable contracting, onboarding, and privacy-notice processes.

For questions about this schedule, data-processing terms, or privacy and security review, contact privacy@aistrova.com.

Read the TruLexa Privacy Policy