Sub-Processors
Last updated: 10 June 2026
LeadLex (Lead IP GmbH) engages the third-party sub-processors listed below to help provide the LeadLex platform. The list is built from an audit of the platform's actual third-party calls and verified provider documentation. Each sub-processor is bound by a data processing agreement with terms no less protective than those LeadLex offers its customers, processes personal data only on LeadLex's documented instructions, and — for any transfer outside the EEA — is covered by appropriate safeguards (EU-US Data Privacy Framework participation and/or the EU Standard Contractual Clauses).
Primary customer data — the database and each workspace's AI compute — is hosted in the EU (Frankfurt, Germany). Self-hosted components (for example, our self-hosted Langfuse LLM-tracing instance) run on our own EU Fly.io infrastructure and are not separate sub-processors.
This list is incorporated into the Data Processing Agreement as Annex 3.
1. Core platform (always used)
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt) | SOC 2 Type II |
| Fly.io | Per-workspace AI compute (Firecracker microVMs) + self-hosted services | EU (Frankfurt) | SOC 2 Type II; ISO 27001 datacenters |
| Vercel | Web-application hosting / edge delivery | EU regions | SOC 2 Type II |
| PostHog | Product analytics / usage telemetry | EU Cloud (Frankfurt) | SOC 2 Type II |
| Resend | Transactional email (system notifications) | EU (Dublin) sending region | SOC 2 Type II; SCCs/DPF for US-processed service metadata |
2. AI providers
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Anthropic | AI inference (Claude) | US | SOC 2 Type II; ISO 27001; no training on customer data; ≤30-day retention |
| Fallback AI inference (Gemini) | US | No training on customer data | |
| OpenAI | Text embeddings; optional voice transcription (Whisper) | US | SOC 2 Type II; no training on API data |
3. Email & calendar (only when the customer connects their account)
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Microsoft | Outlook/Microsoft 365 mail & calendar sync; SSO (Entra ID) | Customer tenant / Microsoft | ISO 27001; SOC 2 Type II |
| Gmail / Google Calendar sync | Customer tenant / Google | ISO 27001; SOC 2 Type II |
4. Optional messaging channels (only where the customer enables the channel)
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Telegram | Lexi messaging channel | Telegram FZ-LLC | Opt-in |
| Meta / WhatsApp | Lexi messaging channel | US / Ireland | Opt-in |
| Slack (Salesforce) | Notifications / integration | US | SOC 2; opt-in |
| Microsoft (Bot Framework / Teams) | Teams channel | US | Opt-in |
| HubSpot | CRM integration (API), where the customer connects it | Customer's HubSpot portal region — EU (Frankfurt) by default for European customers | SOC 2 Type II; opt-in |
5. Billing
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Stripe | Subscription billing & payments | US | PCI DSS Level 1; SOC 2 Type II |
Public data sources (not sub-processors)
EPO / Open Patent Services, EUIPO, WIPO PatentScope, Espacenet, and Google Patents are queried for public IP, patent, and trademark records; no customer personal data is sent to them for processing.
Optional, user-initiated enrichment lookups (e.g. finding a business email address for a prospect) query specialist business-contact databases with only the minimal business identifiers needed for the lookup; details of the providers used are available on request.
Changes and Objection Rights
LeadLex notifies customers of any intended addition or replacement of a sub-processor by email at least 14 days before the new sub-processor begins processing personal data. Customers may object to a new sub-processor on reasonable data-protection grounds within 14 days of notice, as set out in Section 8.2 of the DPA.
To receive sub-processor change notifications, or to ask a question about this list, contact lexi@leadlex.com.