Legal
Sub-processors
Version 1.1 · Last updated 27 September 2026
To deliver the LeakIQ platform, LeakIQ Ltd engages a small number of third-party sub-processors. This page lists them, the data each handles and where it is located. It forms part of the Data Processing Agreement in the Master Subscription Agreement.
1. Overview
A sub-processor is a third party engaged by LeakIQ to process customer personal data on LeakIQ's behalf. LeakIQ keeps its sub-processor list deliberately small, engages each one only where necessary to provide the service, and ensures each is bound by data protection obligations equivalent to LeakIQ's own. All persistent customer data is stored at rest within the EEA (AWS eu-central-1, Frankfurt); some processing takes place outside the EEA under appropriate safeguards, as set out on the International Data Transfers page.
2. Current sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, and storage for workspace data exports | Processed transiently in memory during requests. Workspace exports you generate are stored for collection; nothing else is stored on this layer | EU, AWS eu-central-1 (Frankfurt); US parent company, SCCs / UK Addendum |
| Neon Inc. | PostgreSQL database | All persistent workspace and customer data | EU, AWS eu-central-1 (Frankfurt) |
| Resend Inc. | Transactional email delivery | Recipient email address and notification content | US company; SCCs / UK Addendum |
| Stripe, Inc. | Billing & payment processing | Subscription and billing data only; no revenue-recovery data | Global; SCCs / Data Privacy Framework |
| Upstash, Inc. | Rate limiting (login, password reset, detection) | IP address and workspace identifier, held transiently | US company; SCCs / UK Addendum |
| Functional Software, Inc. (Sentry) | Server-side error and performance monitoring | Exception stack traces and request diagnostics, tagged with a workspace identifier. Personal-data capture is not enabled | EU data region (Frankfurt); US parent company, SCCs / UK Addendum |
| Anthropic PBC | AI-assisted drafting in the issue assistant. Off unless your workspace enables it, see below | Where enabled: the description and metadata of a revenue issue, with its associated figures. No credentials, and no bulk export of your data | US company; SCCs / UK Addendum |
Anthropic is listed in advance, and the assistant is off unless your workspace turns it on. It is a per-workspace choice and every workspace starts with it off, so no data reaches Anthropic for your workspace unless you enable it. It is listed here so that this disclosure, and the 30 days' notice described below, are in place before it is ever switched on rather than after. When it is enabled, its only job is to draft prose: a summary, suggested steps, an explanation, on an individual issue's detail page. It never calculates or alters a figure. Every amount LeakIQ reports is computed by the platform from your own records. See A word on AI.
Where a sub-processor is a non-UK/EU company, transfers are covered by appropriate safeguards such as the Standard Contractual Clauses with the UK Addendum and, where applicable, the EU-US / UK-US Data Privacy Framework. Full detail is on the International Data Transfers page.
3. Changes and notification
- LeakIQ notifies customers of any intended addition or replacement of a sub-processor at least 30 days in advance.
- Customers may object on reasonable data-protection grounds during that period; LeakIQ will work in good faith to address the concern.
- To receive change notifications, email support@leakiq.io and ask to be added to the sub-processor updates list.
4. Sub-processor obligations
Each sub-processor is engaged under a written agreement that imposes data protection obligations equivalent to those LeakIQ owes its customers, including confidentiality, appropriate technical and organisational security measures, and restrictions on the use of customer data. LeakIQ remains responsible to its customers for the performance of its sub-processors.
For related documents, see the International Data Transfers page, the Data Retention & Deletion Policy and the Trust Centre.