Sub-processors
Who processes data on our behalf.
A versioned register of third-party processors used to operate LumenFlow Cloud, with purpose, region, and an honest DPA column.
Register version 1.0.0
Current register
The DPA column states only what is signed. No customer DPA exists until one is counter-signed.
| Processor | Purpose | Region | DPA |
|---|---|---|---|
| Supabase | Database hosting and authentication. | EU (AWS eu-central-1); US infrastructure also used for auth edges | No DPA is signed with this processor yet. |
| Vercel | Application hosting and edge delivery. | EU (Vercel fra1 / AWS eu-central-1) | No DPA is signed with this processor yet. |
| Stripe | Payment processing for paid plans (web only). | United States / global Stripe infrastructure | No DPA is signed with this processor yet. |
| OpenAI | Text inference and, for mobile dictation, voice transcription via the OpenAI Realtime API (forwarded server-side). | United States | No DPA is signed with this processor yet. |
| Anthropic | Text inference under the managed-inference tier. | United States | No DPA is signed with this processor yet. |
| Google Gemini | Text inference under the managed-inference tier. | United States / Google Cloud regions | No DPA is signed with this processor yet. |
| GitHub | Optional connected tool — when a workspace connects its own GitHub account, LumenFlow can read and write to authorised repositories. | United States | No DPA is signed with this processor yet. |
| Expo / EAS | Mobile push token issuance and over-the-air update delivery for the mobile app. | United States | No DPA is signed with this processor yet. |
Change log
v1.0.0 effective 2026-09-22
Initial public sub-processor register.
- Published the initial versioned list aligned with the privacy-policy processors (Supabase, Vercel, Stripe, OpenAI, Anthropic, Google Gemini, GitHub, Expo / EAS).
- DPA column records that no customer DPA is signed yet.
Related: Trust centre · Privacy policy