Sub-processors
THEMIS is provided by Olympus Group Holdings, Inc.. To deliver the service we use the service providers listed below. Each third-party system receives only the data it needs for its stated purpose, and each is bound by a written contract that limits its use of that data and requires appropriate security and confidentiality.
This list covers the providers that process information on behalf of a practice that uses THEMIS. Where a provider's processing region is not stated here, we have not published it, and we will confirm it to any customer on request. The Data Processing Agreement and the Privacy Policy explain how transfers are made lawful.
Primary hosting: Ireland
These two providers carry the service and hold the practice's records.
| Sub-processor | Purpose | Data categories processed | Data residency | Legal entity | Used |
|---|---|---|---|---|---|
| Vercel | Application hosting, serverless computing and content delivery. | Everything a person views or submits while using THEMIS, and request details such as IP address and browser type. | Dublin, Ireland for computing. Cached public pages and images are served from edge locations worldwide. | Vercel Inc. | Always |
| Supabase | Database and file storage. | The practice's records, matters, documents, user accounts, audit trail and uploaded files. Each practice's data is separated at database level. | Ireland (EU West) | Supabase, Inc. | Always |
Providers used for a specific function
These providers handle data only for the function named, and only when that function is used.
| Sub-processor | Purpose | Data categories processed | Data residency | Legal entity | Used |
|---|---|---|---|---|---|
| NVIDIA | AI model inference for the assistant, drafting and review features. | The text a person asks about and the context sent with it, such as extracts of the matter or document in question. | Provider-operated infrastructure. The region is confirmed on request. | NVIDIA Corporation | Only when a person uses an AI feature |
| Resend | Delivery of email that THEMIS sends. | Recipient name and email address, and the content of the message, such as an invitation, a signing request, an invoice or a reminder. | Provider-operated infrastructure. The region is confirmed on request. | Resend, Inc. | When THEMIS sends an email |
| Stripe | Subscription billing and card payments for the practice's plan. | Billing contact, practice name, plan and number of seats, and payment card details, which are collected by Stripe and not stored by THEMIS. | Provider-operated infrastructure. The region is confirmed on request. | Stripe, Inc. | Where the practice has a paid plan |
| Didit | Electronic identity (KYC) and business (KYB) verification. | Identity documents, a face image and liveness check, identity numbers, name, date of birth, and company registration details of the person or business being verified. | Provider-operated infrastructure. The region is confirmed on request. | Didit (as named in our contract) | Only where the practice turns on electronic verification and a person is invited to verify |
Changes to this list
We give at least 30 days' notice before adding or replacing a sub-processor that handles a practice's content. A practice may object on reasonable data protection grounds within that time, as the Data Processing Agreement set out. To be told when this list changes, write to privacy@olympuspay.co.
Questions and the named contracts
For a provider's processing region, its transfer safeguards, or the contract terms that apply to a practice, write to privacy@olympuspay.co. Related documents: Privacy Policy, Data Processing Agreement, Security.
Olympus Group Holdings, Inc., 1111B S Governors Ave, STE 25834, Dover, DE 19904, USA.