Mylo Prime
Mylo Prime — Sub-processor List
Version: 1.1 Effective Date: February 1, 2026 Last Updated: August 1, 2026 — added ElevenLabs, Deepgram, and Meta (AI providers in production use); added Document Storage & E-Signature (Dropbox, SignNow) and Financial Data (Plaid, Intuit) sections; added Cloudflare. This update reconciles the list to the operating system inventory (SECURITY.md §17) before the first external customer signs; no processor was removed. Updated August 2, 2026: removed a placeholder row for a customer-support platform that has not been adopted.
This page lists the third-party Sub-processors that Mylo Prime LLC engages to provide the Mylo Prime services. The list is incorporated by reference into the Terms of Service, the Privacy Policy, and the Data Processing Addendum.
We provide at least fifteen (15) days’ advance notice of changes to this list (or seven (7) days for Beta Service customers). Customers who wish to receive change notifications by email may subscribe at [email protected]. Objection rights and procedures are described in Section 6 of the DPA.
Conventions used below. “Location of processing” lists the Sub-processor’s primary processing regions for the Service; some Sub-processors may also store data in other regions for redundancy or backup. “AI-training posture” identifies whether the Sub-processor uses customer data to train its own foundation models. Mylo Prime does not authorize any AI Sub-processor to use Customer Data for training, and routes Customer Data only to API endpoints where training is contractually excluded.
1. Artificial Intelligence Model Providers
| Sub-processor | Function | Data categories processed | Location of processing | AI-training posture | Transfer mechanism |
|---|---|---|---|---|---|
| Anthropic, PBC | Foundation model inference (Claude family) used for reasoning, drafting, summarization, classification, and agent actions. | Prompts, prompt context (which may include Customer Data the user attaches or references), system instructions, generated Outputs, telemetry. | United States. | API endpoints contractually exclude use of customer data for training. Anthropic’s standard retention is up to 30 days for abuse monitoring. | SCCs (where applicable). |
| xAI Corp. | Foundation model inference (Grok family) used for reasoning and generation in selected workflows. | Prompts, prompt context, system instructions, generated Outputs, telemetry. | United States. | API endpoints used contractually exclude training. Standard retention applies for abuse monitoring. | SCCs (where applicable). |
| OpenAI, L.L.C. (if and when used) | Foundation model inference (GPT family) for limited features. | Prompts, prompt context, system instructions, generated Outputs, telemetry. | United States. | API platform contractually excludes training by default. Standard 30-day retention applies. | SCCs (where applicable). |
| Google LLC (Vertex AI / Gemini) | Foundation model inference (Gemini family) used for selected workflows. | Prompts, prompt context, system instructions, generated Outputs, telemetry. | United States (multi-region). | Vertex AI / paid Gemini API endpoints contractually exclude training. | SCCs (where applicable). |
| Meta Platforms, Inc. | Foundation model inference (Muse Spark) — restricted internal workflows only; excluded from the chat composer and model-fallback ladders. | Prompts, prompt context, system instructions, generated Outputs, telemetry. | United States. | API endpoints used contractually exclude training. | SCCs (where applicable). |
| ElevenLabs, Inc. | Voice synthesis for AI telephony (the voice callers hear) and retrieval of AI-call audio/transcripts. | Call audio, call transcripts, voice-prompt text (which may reference Customer Data), telephony metadata. | United States. | API tier used does not train on customer content. | SCCs (where applicable). |
| Deepgram, Inc. | Real-time speech-to-text for consultations, call recordings, and live transcription features. | Audio streams and resulting transcripts (which may contain Customer Data), session metadata. | United States. | API tier used does not train on customer content. | SCCs (where applicable). |
2. Cloud Infrastructure
| Sub-processor | Function | Data categories processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Google LLC (Google Cloud Platform) | Cloud compute (Cloud Run), database (Cloud SQL for PostgreSQL), object storage (Cloud Storage), secret management (Secret Manager), identity (IAM), logging and monitoring (Cloud Logging, Cloud Monitoring), build (Cloud Build), and related infrastructure. | All Customer Data and Personal Data hosted by the Service. | United States (us-central1 primary). | SCCs (where applicable). |
| Google LLC (Google Workspace) | Email, productivity, and collaboration tooling for Mylo Prime personnel; integration source for Customer-authorized Gmail / Calendar / Drive integrations. | Communications metadata; Customer Data shared only for authorized integrations and at Customer’s direction. | United States. | SCCs (where applicable). |
| Cloudflare, Inc. | DNS and bot protection (Turnstile) on public and client-portal endpoints. | Request metadata (IP address, user agent) for DNS resolution and bot challenges; no Customer file content. | United States (global edge). | SCCs (where applicable). |
2a. Document Storage and E-Signature
| Sub-processor | Function | Data categories processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Dropbox, Inc. | Client-matter document storage and synchronization (where the Customer’s document storage is configured on Dropbox). | Client documents and firm files, folder metadata. | United States. | SCCs (where applicable). |
| airSlate, Inc. (SignNow) | Electronic signature — envelope preparation, signing, and sealed-document storage. | Documents sent for signature (which contain Customer Data), signer names/emails, signature events and audit trails. | United States. | SCCs (where applicable). |
2b. Financial Data
| Sub-processor | Function | Data categories processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Plaid Inc. | Bank-account connectivity for trust and operating accounts (balances, transactions) where the Customer enables bank feeds. | Bank account identifiers, balances, transactions, institution metadata. | United States. | SCCs (where applicable). |
| Intuit Inc. (QuickBooks Online) | Accounting synchronization and trust reconciliation where the Customer connects QuickBooks. | Invoices, payments, customer/vendor records, trust-liability balances. | United States. | SCCs (where applicable). |
3. Communications
| Sub-processor | Function | Data categories processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Twilio Inc. | SMS, voice, and recording infrastructure for telephony and messaging features. | Phone numbers, message content, call audio (where recording is enabled), call metadata. | United States. | SCCs (where applicable). |
4. Payments
| Sub-processor | Function | Data categories processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Stripe, Inc. | Subscription billing and payment-card processing for Mylo Prime fees. | Payer name, billing address, email, payment-card data (Stripe is the controller for full card data), transaction metadata. | United States. | SCCs (where applicable). |
| AffiniPay, LLC (LawPay) | Trust-account and operating-account payment processing for legal-industry customers’ end clients (only when Customer enables and uses the LawPay integration). | Payer name, contact, payment-card / ACH data, matter and trust-related metadata. | United States. | SCCs (where applicable). |
5. Identity and Authentication
| Sub-processor | Function | Data categories processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Google LLC (Google Identity / OAuth) | Single sign-on for Authorized Users using Google credentials. | Email, profile, OAuth tokens for authorized scopes. | United States. | SCCs (where applicable). |
| Microsoft Corporation (Entra ID) (if and when enabled) | Single sign-on for Authorized Users using Microsoft credentials. | Email, profile, OAuth tokens for authorized scopes. | United States. | SCCs (where applicable). |
6. Observability and Support
| Sub-processor | Function | Data categories processed | Location of processing | Transfer mechanism |
|---|---|---|---|---|
| Sentry / Error-tracking provider (currently: Google Cloud Error Reporting) | Application error and exception aggregation. | Error stack traces, request metadata; PII redacted where practicable. | United States. | SCCs (where applicable). |
Notes
- This list reflects production Sub-processors. Mylo Prime may use additional vendors for narrowly-scoped purposes (e.g., DNS, CDN, certificate authorities, security-scanning tools) that do not Process Customer Personal Data in any meaningful way; those vendors are not listed here.
- For Beta Service users, the advance-notice period for new Sub-processors is seven (7) days rather than fifteen (15), per the Beta Addendum.
- For questions about a specific Sub-processor, contact [email protected].