Data Processing Agreement
Version 1.0 · September 25, 2026
BigLaw Bear’s Data Processing Agreement covers our role as a processor of the candidate and user data firms manage in the Firm Portal. It includes CCPA service provider terms, our security measures, 72-hour breach notice, 30 days’ notice of new sub-processors, audit rights, deletion at the end of the agreement, and Standard Contractual Clauses where EU or UK transfers apply.
The full agreement text is in the Firm Portal under Data Processing Agreement. Sign-in is required because the portal shows the version your firm accepted.
To sign, add your firm’s legal name and signature and send the signed copy to hello@biglawbear.com. We countersign within two business days. Questions about the DPA or our security questionnaire go to the same address.
Current sub-processors
- Supabase (on AWS, US West): Database, authentication, file storage
- Vercel: Application hosting, edge network, cookieless page-view analytics
- Resend: Transactional email
- Google Workspace: Business email and meeting calendar
- Cloudflare: DNS, edge network, bot protection
- Sentry: Error monitoring
- Twilio: SMS verification codes
Daily and Stripe support optional features that are not currently enabled and receive no firm data. We give firms 30 days’ notice before any new sub-processor handles their data.
BigLaw Bear does not currently use artificial intelligence or automated decision-making on student or firm data.
See also our Privacy Policy, Terms of Service, and Security Practices.