Subprocessors

Third parties that process personal data on behalf of Maggie when delivering the service. Last updated: June 2026.

When a law firm ("Controller") uses Maggie, Maggie Legal CRM ("Processor") may engage the subprocessors below. AI components (Ollama, Qdrant) run on infrastructure controlled by the deployment — they are not listed as external cloud AI subprocessors in the default self-hosted configuration.

Data flow overview

Law Firm (Controller)
        │
        ▼
┌───────────────────┐
│  Maggie Platform  │  PostgreSQL · File storage · Audit logs
│  (Processor)      │  Tenant isolation by tenant_id
└─────────┬─────────┘
          │
    ┌─────┼─────┬─────────────┐
    ▼     ▼     ▼             ▼
 Resend Stripe  Hosting    Ollama/Qdrant*
 (email) (pay)  (VPS)      (on-prem AI)*

* Same deployment by default — data stays on firm-controlled infra

Authorized subprocessors

Resend, Inc.

Purpose: Transactional email (invitations, portal notifications, invoices, reminders)
Data categories: Recipient email, name, message content, metadata
Location: United States
Safeguards: DPA available; TLS in transit

Stripe, Inc.

Purpose: Payment processing for client invoices (optional, when enabled by the firm)
Data categories: Payment method tokens, billing email, transaction amounts
Location: United States / global infrastructure
Safeguards: PCI-DSS; Stripe DPA

Infrastructure provider (hosting)

Purpose: Application hosting, database, file storage, backups
Data categories: All platform data processed on behalf of the firm
Location: United States (production: maggie.law deployment)
Safeguards: TLS, access controls, tenant isolation

Changes

We will notify firm administrators of material changes to this list (new subprocessor or change in purpose) with at least 30 days notice when required by applicable law or contract. Objections may be submitted to privacy@maggie.law.

Authorized subprocessors

Changes

Related documents