Legal
Sub-processors
Version 1.0 · Last updated August 2026
To deliver the LeakIQ platform, LeakIQ Ltd engages a small number of third-party sub-processors. This page lists them, the data each handles and where it is located. It forms part of the Data Processing Agreement in the Master Subscription Agreement.
1. Overview
A sub-processor is a third party engaged by LeakIQ to process customer personal data on LeakIQ's behalf. LeakIQ keeps its sub-processor list deliberately small, engages each one only where necessary to provide the service, and ensures each is bound by data protection obligations equivalent to LeakIQ's own. All persistent customer data is stored at rest within the EEA (AWS eu-west-1, Ireland); some processing takes place outside the EEA under appropriate safeguards, as set out on the International Data Transfers page.
2. Current sub-processors
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Vercel Inc. | Application hosting & serverless compute | Processed transiently in memory during requests; none stored on this layer | US company; SCCs / UK Addendum |
| Neon Inc. | PostgreSQL database | All persistent workspace and customer data | EU, AWS eu-west-1 (Ireland) |
| Resend Inc. | Transactional email delivery | Recipient email address and notification content | US company; SCCs / UK Addendum |
| Stripe, Inc. | Billing & payment processing | Subscription and billing data only; no revenue-recovery data | Global; SCCs / Data Privacy Framework |
Where a sub-processor is a non-UK/EU company, transfers are covered by appropriate safeguards such as the Standard Contractual Clauses with the UK Addendum and, where applicable, the EU-US / UK-US Data Privacy Framework. Full detail is on the International Data Transfers page.
3. Changes and notification
- LeakIQ notifies customers of any intended addition or replacement of a sub-processor at least 30 days in advance.
- Customers may object on reasonable data-protection grounds during that period; LeakIQ will work in good faith to address the concern.
- To receive change notifications, email support@leakiq.io and ask to be added to the sub-processor updates list.
4. Sub-processor obligations
Each sub-processor is engaged under a written agreement that imposes data protection obligations equivalent to those LeakIQ owes its customers, including confidentiality, appropriate technical and organisational security measures, and restrictions on the use of customer data. LeakIQ remains responsible to its customers for the performance of its sub-processors.
For related documents, see the International Data Transfers page, the Data Retention & Deletion Policy and the Trust Centre.