Legal
International Data Transfers
Version 1.2 · Last updated 7 October 2026 · Next review September 2027
This page explains where LeakIQ Ltd stores and processes personal data, and the safeguards applied when data is processed outside the United Kingdom or European Economic Area (EEA). It supports the international-transfer terms of our Data Processing Agreement and should be read with the sub-processor list.
1. Overview
LeakIQ only ever reads from a customer's systems, never writing to, modifying or deleting a record in any of them (the per-connector access detail is at leakiq.io/trust/access), and holds only the financial records needed to detect revenueleakage. Persistent customer data is stored at rest within the EEA, and application compute runs in the EEA too. Several sub-processors perform supporting functions from the United States, including transactional email, LeakIQ's own billing, rate limiting and, where a workspace enables it, AI-assisted drafting. Error monitoring stores in the EEA, with US parent-company support access covered by the same safeguards. The table below gives the full position for each. Where they do, the personal data involved is limited and is protected by appropriate transfer safeguards.
2. Where data is stored
Persistent workspace and customer data is stored at rest within the EEA, in Amazon Web Services eu-central-1 (Frankfurt), through our database provider Neon. This is the system of record for connector data, recovery cases and the audit log. The one other place customer data rests is the export archive: when you generate a workspace export it is written to a private Vercel Blob store for you to collect, and nothing else is kept on that layer.
3. Processing outside the UK and EEA
Some processing is carried out by sub-processors in the United States. The data involved is limited to what each function requires:
| Sub-processor | Function | Personal data involved | Safeguard |
|---|---|---|---|
| Vercel Inc. | Application hosting and serverless compute, pinned to the eu-central-1 (Frankfurt) region, and storage for workspace data exports in a private Blob store created in the same region | Processed transiently in memory while a request runs. Workspace exports you generate are stored for collection; nothing else is stored on this layer | Processed in the EEA; SCCs + UK Addendum cover US parent access |
| Resend Inc. (US) | Transactional email delivery | Recipient email address and the content of notification emails | SCCs + UK Addendum |
| Stripe, Inc. (US) | Billing and payment processing (LeakIQ's own billing) | Subscription and billing-contact data only; no revenue-recovery data | SCCs + Data Privacy Framework |
| Upstash, Inc. (US) | Rate limiting on login, password reset and detection runs | IP address and workspace identifier, held transiently | SCCs + UK Addendum |
| Functional Software, Inc. (Sentry) | Server-side error and performance monitoring, EU data region (Frankfurt) | Exception stack traces and request diagnostics, tagged with a workspace identifier; personal-data capture is not enabled | Stored in the EEA; SCCs + UK Addendum cover US parent support access |
| Anthropic PBC (US) | AI-assisted drafting in the issue assistant. Off unless your workspace enables it; no data is sent for a workspace that has not | Where enabled: the description, metadata and figures of an individual revenue issue. Never credentials, and never a bulk export | SCCs + UK Addendum |
Neon (database) stores data in the EEA and is not a restricted transfer for storage. The live list, with each sub-processor's purpose and location, is maintained on the sub-processor page.
4. Transfer safeguards
Where personal data is processed outside the UK or EEA, LeakIQ relies on the safeguards set out in each provider's data processing terms, namely the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum (and, for Stripe, certification under the EU-US and UK-US Data Privacy Framework). LeakIQ minimises the personal data that leaves the EEA and keeps the storage system of record in the EEA.
5. What this means
- Your data is stored at rest in the EEA (AWS eu-central-1, Frankfurt).
- Application compute runs in the EEA too, pinned to the eu-central-1 (Frankfurt) region.
- Transactional email, billing, rate limiting and, where enabled, AI-assisted drafting take place in the US under the Standard Contractual Clauses and the UK Addendum. Error monitoring stores in the EEA, with US parent-company support access covered by the same safeguards.
- LeakIQ connects read-only and never writes back or moves your data.
- The sub-processor list is kept current, and customers are given at least 30 days' notice of any change.
Questions about data location or transfers can be sent to support@leakiq.io.