Sub-Processors
Last updated: 14 August 2026
LeadLex (Lead IP GmbH) engages the third-party sub-processors listed below to help provide the LeadLex platform. The list is built from an audit of the platform's actual third-party calls and verified provider documentation. Each sub-processor is bound by a data processing agreement with terms no less protective than those LeadLex offers its customers, processes personal data only on LeadLex's documented instructions, and — for any transfer outside the EEA — is covered by appropriate safeguards (EU-US Data Privacy Framework participation and/or the EU Standard Contractual Clauses).
Primary customer data — the database and each workspace's AI compute — is hosted in the EU (Frankfurt, Germany). Self-hosted components (for example, our self-hosted Langfuse LLM-tracing instance) run on our own EU Fly.io infrastructure and are not separate sub-processors.
This list is incorporated into the Data Processing Agreement as Annex 3.
1. Core platform (always used)
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU (Frankfurt) | SOC 2 Type II |
| Fly.io | Per-workspace AI compute (Firecracker microVMs) + self-hosted services | EU (Frankfurt) | SOC 2 Type II; ISO 27001 datacenters |
| Vercel | Web-application hosting / edge delivery | EU regions | SOC 2 Type II |
| PostHog | Product analytics / usage telemetry | EU Cloud (Frankfurt) | SOC 2 Type II |
| Resend | Transactional email (system notifications) | EU (Dublin) sending region | SOC 2 Type II; SCCs/DPF for US-processed service metadata |
2. AI providers
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Anthropic | AI inference (Claude) | US | SOC 2 Type II; ISO 27001; no training on customer data; ≤30-day retention |
| Fallback AI inference (Gemini) | US | No training on customer data | |
| OpenAI | Text embeddings; optional voice transcription (Whisper) | US | SOC 2 Type II; no training on API data |
3. Email & calendar (only when the customer connects their account)
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Microsoft | Outlook/Microsoft 365 mail & calendar sync; SSO (Entra ID) | Customer tenant / Microsoft | ISO 27001; SOC 2 Type II |
| Gmail / Google Calendar sync | Customer tenant / Google | ISO 27001; SOC 2 Type II |
4. Optional messaging channels (only where the customer enables the channel)
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Telegram | Lexi messaging channel | Telegram FZ-LLC | Opt-in |
| Meta / WhatsApp | Lexi messaging channel | US / Ireland | Opt-in |
| Slack (Salesforce) | Notifications / integration | US | SOC 2; opt-in |
| Microsoft (Bot Framework / Teams) | Teams channel | US | Opt-in |
| HubSpot | CRM integration (API), where the customer connects it | Customer's HubSpot portal region — EU (Frankfurt) by default for European customers | SOC 2 Type II; opt-in |
5. Billing
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| Stripe | Subscription billing & payments | US | PCI DSS Level 1; SOC 2 Type II |
6. Website analytics (public marketing site only — not customer data)
These process website visitor data on leadlex.com. They have no access to the LeadLex platform, and no customer, client, or matter data reaches them. Both load only after a visitor selects "Accept all" in the cookie banner — see the Cookie Policy.
| Sub-Processor | Purpose | Location | Notes |
|---|---|---|---|
| PostHog | Website analytics (page views, funnel) | EU Cloud (Frankfurt) | Requests routed through leadlex.com; session replay disabled |
| Google (Analytics 4) | Website analytics | Google Ireland Ltd; transfers to Google LLC (US) | EU–US Data Privacy Framework + SCCs; Consent Mode v2; advertising storage permanently denied |
Public data sources (not sub-processors)
EPO / Open Patent Services, EUIPO, WIPO PatentScope, Espacenet, and Google Patents are queried for public IP, patent, and trademark records; no customer personal data is sent to them for processing.
Optional, user-initiated enrichment lookups (e.g. finding a business email address for a prospect) query specialist business-contact databases with only the minimal business identifiers needed for the lookup; details of the providers used are available on request.
Changes and Objection Rights
LeadLex notifies customers of any intended addition or replacement of a sub-processor by email at least 14 days before the new sub-processor begins processing personal data. Customers may object to a new sub-processor on reasonable data-protection grounds within 14 days of notice, as set out in Section 8.2 of the DPA.
To receive sub-processor change notifications, or to ask a question about this list, contact lexi@leadlex.com.