Subprocessors
Everyone who touches data on our behalf, what they do, and where. Always public — the objection right in the DPA cannot work otherwise.
Last updated 24 September 2026
Draft. This page is being finalised with counsel and is not yet binding. Questions: [email protected].
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare | CDN, TLS termination, DNS, bot protection | Request metadata, IP addresses | United States |
| OAuth sign-in (identity provider) | Email, name, avatar — only what you authorise | United States | |
| Meta / Facebook | OAuth sign-in (identity provider) | Email, name, avatar — only what you authorise | United States |
| OAuth sign-in (identity provider) | Email, name, avatar — only what you authorise | United States | |
| GitHub | OAuth sign-in (identity provider) | Email, name, avatar — only what you authorise | United States |
| LNBOX (transactional email) | Notifying our team of access requests | The email address and message you submit | To be confirmed |
| Site analytics (Google Analytics) | Pages viewed, device and browser type, approximate location | United States | |
| Hosting provider | Infrastructure | All service data | To be confirmed |
Changes
We will post new subprocessors here before they begin processing. Customers under the DPA may object within the notice window set in the DPA.