Legal
International Data Transfers
Version 1.0 · Last updated August 2026 · Next review August 2027
This page explains where LeakIQ Ltd stores and processes personal data, and the safeguards applied when data is processed outside the United Kingdom or European Economic Area (EEA). It supports the international-transfer terms of our Data Processing Agreement and should be read with the sub-processor list.
1. Overview
LeakIQ connects to a customer's systems on a read-only basis and holds only the financial records needed to detect revenue leakage. Persistent customer data is stored at rest within the EEA. A small number of sub-processors perform specific functions, namely application compute, transactional email and billing, from the United States; where they do, the personal data involved is limited and is protected by appropriate transfer safeguards.
2. Where data is stored
All persistent workspace and customer data is stored at rest within the EEA, in Amazon Web Services eu-west-1 (Ireland), through our database provider Neon. This is the system of record for connector data, recovery cases and the audit log.
3. Processing outside the UK and EEA
Some processing is carried out by sub-processors in the United States. The data involved is limited to what each function requires:
| Sub-processor | Function | Personal data involved | Safeguard |
|---|---|---|---|
| Vercel Inc. (US) | Application hosting and serverless compute | Customer data is processed transiently in memory while a request runs; nothing is stored on this layer | SCCs + UK Addendum |
| Resend Inc. (US) | Transactional email delivery | Recipient email address and the content of notification emails | SCCs + UK Addendum |
| Stripe, Inc. (US) | Billing and payment processing (LeakIQ's own billing) | Subscription and billing-contact data only; no revenue-recovery data | SCCs + Data Privacy Framework |
Neon (database) stores data in the EEA and is not a restricted transfer for storage. The live list, with each sub-processor's purpose and location, is maintained on the sub-processor page.
4. Transfer safeguards
Where personal data is processed outside the UK or EEA, LeakIQ relies on the safeguards set out in each provider's data processing terms, namely the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum (and, for Stripe, certification under the EU-US and UK-US Data Privacy Framework). LeakIQ minimises the personal data that leaves the EEA and keeps the storage system of record in the EEA.
5. What this means
- Your data is stored at rest in the EEA (AWS eu-west-1, Ireland).
- Limited processing (compute, email, billing) takes place in the US under the Standard Contractual Clauses and the UK Addendum.
- LeakIQ connects read-only and never writes back or moves your data.
- The sub-processor list is kept current, and customers are given at least 30 days' notice of any change.
Questions about data location or transfers can be sent to support@leakiq.io.