Skip to main content

Data Processing Agreement

Version 1.0 · September 25, 2026

BigLaw Bear’s Data Processing Agreement covers our role as a processor of the candidate and user data firms manage in the Firm Portal. It includes CCPA service provider terms, our security measures, 72-hour breach notice, 30 days’ notice of new sub-processors, audit rights, deletion at the end of the agreement, and Standard Contractual Clauses where EU or UK transfers apply.

The full agreement text is in the Firm Portal under Data Processing Agreement. Sign-in is required because the portal shows the version your firm accepted.

To sign, add your firm’s legal name and signature and send the signed copy to tulio@biglawbear.com. We countersign within two business days. Questions about the DPA or our security questionnaire go to the same address.

School-provided education records

Where a law school uses the service to provide student education records for career services, the school and BigLaw Bear must enter into a separate School Data Use Agreement before those records are transferred. That agreement sets each party’s obligations for school-directed processing, permitted use, access, redisclosure, retention and disposition of those records. It is not part of this DPA, and this DPA does not make any customer subject to it.

To the extent this DPA also applies to that processing, the School Data Use Agreement controls where the two directly conflict over school-provided education records, unless the parties agree otherwise in writing. Nothing in this DPA on its own authorizes a disclosure of education records under FERPA.

Read the School Data Use Agreement.

Current sub-processors

  • Supabase (on AWS, US West): Database, authentication, file storage
  • Vercel: Application hosting, edge network, cookieless page-view analytics
  • Resend: Transactional email
  • Google Workspace: Business email and meeting calendar
  • Cloudflare: DNS, edge network, bot protection
  • Sentry: Error monitoring
  • Twilio: SMS verification codes

Daily and Stripe support optional features that are not currently enabled and receive no firm data. We give firms 30 days’ notice before any new sub-processor handles their data.

BigLaw Bear does not currently use artificial intelligence or automated decision-making on student or firm data.

See also our Privacy Policy, Terms of Service, and Security Practices.