Subprocessors
To run Enqlave we rely on a small number of trusted service providers (“subprocessors”) that process data on our behalf. We keep this list short by design, and we publish it so you always know who is involved.
| Subprocessor | Purpose | What they process | Location |
|---|---|---|---|
| Supabase, Inc. | Account sign-in, encrypted library sync and storage, diagnostics | Account identifiers; your library only as encrypted ciphertext we cannot read; the names you give your libraries and a fingerprint of each file’s contents, neither of which is encrypted; a timestamped record of every change each device syncs; how much AI you use (token counts per model per day, and roughly what for); diagnostic measurements, counts and error codes | United States |
| Google LLC (Gemini API) | Reads and describes documents you import, builds the index behind search by meaning, and answers questions — when you have configured a Gemini key | The document files themselves, extracts used for the search index, and your questions — sent directly from your device, using your own API key, at the moment of each call | United States |
| Anthropic, PBC (Claude API) | Reads and describes documents, and answers questions — when you have configured a Claude key | The document files themselves and your questions, sent directly from your device, using your own API key, at the moment of each call | United States |
| OpenRouter, Inc. | Carries the same AI work — reading, indexing and answering — for people who have not configured a key of their own | The document files themselves, extracts used for the search index, and your questions — sent directly from your device, at the moment of each call, under a key we issue for your account. OpenRouter is a router: it passes each request to a model provider, which performs the work | United States |
| Google LLC (Drive API) | Imports documents from Google Drive folders you connect — only if you connect one | The folders you connect and the files you import from them. Google records a read-only grant over your whole Drive, because a narrower one cannot list files that were already in a folder you pick; Enqlave reads only the folders you connect | United States |
| Apple Inc. (App Store) | App distribution (TestFlight) and Sign in with Apple | Your Apple Account identifier and basic install/device information | United States |
| Apple Inc. (Maps) | Turns place names found in your documents into map coordinates — only if you turn place lookup on — and serves the map itself when you open it | The place names themselves, which may be addresses, employers, clinics, schools or courts. Opening the map also requests map tiles for the area shown, which is framed on your documents’ own locations. Separately, if you tag a scan with where it was taken on iPhone, that device location is sent to be turned into a place name | United States |
Enqlave sends document content to an AI provider whenever it reads, indexes, summarises or answers. In practice that is most often three moments: when a document is first read and described, when extracts from it are turned into the vectors behind search by meaning, and when you ask a question. Those are the common ones, not an exhaustive list. The first two happen on their own, as part of filing a document — you don’t have to ask for them. When a document is read, what leaves your device is the file itself, not a summary or an extract of it. In every case the request goes straight from your device to the provider, not through a server we operate, and we keep no copy of what is sent.
Which provider receives it depends on your keys. If you have configured your own Gemini or Claude key, that key is used and the request goes to that provider — this is unchanged. If you have configured no key, Enqlave uses a key we issue and pay for, and the request goes to OpenRouter, which passes it to a model provider. Requests on that path carry a zero-data-retention flag, which restricts them to endpoints that do not retain what they are sent.
Your stored library is encrypted on your device before it syncs; our cloud holds it as ciphertext it cannot read. That holds on both paths — our servers issue the key, they never see the document.
Two things in that store are not encrypted, and we would rather name them than let “encrypted” imply more than it does. The first is the name you give a library. The second is a fingerprint — a SHA-256 hash — of each file’s contents, which is how your devices recognise the same document and store it only once. Because that fingerprint is computed from the file, somebody who already holds an identical copy of a file could confirm it is in your library; it does not reveal a document to anyone who has never seen it.
Apple receives place names only if you turn on place lookup, which is off by default and lives in Enqlave’s settings. When it is on, place names our AI found in your documents are sent to Apple’s geocoding service to be turned into map coordinates. Turning it off stops new lookups; places already found stay on your map. Location tagging on iPhone — recording where a scan was taken — is a separate feature behind the system location permission.
One path involves no subprocessor at all: when you save a web page, your device fetches that page from the site directly, the way a browser would, so that website sees the request.
Our marketing website is hosted by Netlify, Inc. and the domain is registered with Porkbun, LLC. These handle only website data — never your documents.
We’ll update this page before adding or changing a subprocessor. Questions: hello@enclave-ai.com.
← Back to home