1. About this list
Leafer engages each of the sub-processors listed below to deliver specific parts of the service. Every sub-processor is bound by a written Data Processing Addendum aligned with GDPR Art. 28 that mirrors the protections in our DPA with you. Where personal data is transferred outside the European Union, the relevant Standard Contractual Clauses are in place.
The list reflects the current state of the platform. New sub-processors are evaluated against the same criteria — security posture, legal basis for processing, geographic location, signed DPA — and added only after review by the data-protection lead.
2. Change notifications
We notify registered customers by email at least thirty days before adding a new sub-processor or materially expanding what an existing one does. You can object during that window; objections may be resolved through configuration changes, by switching sub-processor, or by terminating the affected contract.
To receive change notifications, subscribe by emailing privacy@leafer.io with the subject line Subprocessor notifications. We keep the list confidential to subscribers.
3. Current sub-processors
The complete list as of 3 June 2026:
| Vendor | Purpose | Location | DPA |
|---|---|---|---|
| Neon Postgres | Primary database | EU · Frankfurt | View |
| Vercel | Web hosting + edge runtime | Global | View |
| Anthropic | LLM for draft generation + classification | US | View |
| OpenAI | LLM fallback path | US | View |
| OpenRouter | LLM gateway routing | US | View |
| Resend | Transactional email + webhook handling | EU | View |
| Clerk | Authentication, sessions, and MFA | US | View |
| Stripe | Billing + payment processing | US · EU | View |
| Redis Cloud | Queueing, caching, rate limiting | EU | View |
| Apify | Court-validated public-web scraping | EU | View |
| Hunter | Email enrichment waterfall | EU | View |
| NeverBounce | Email address verification | US | View |
| PostHog | Product analytics with PII stripped at intake | EU | View |
| Sentry | Error monitoring with PII masking | EU | View |
4. Vendor categories
Sub-processors fall into six functional categories. Each category sits behind its own access controls, retention rules, and incident-response runbook.
- Infrastructure. Database, hosting, edge runtime, queueing, caching. EU-first.
- Communications. Transactional email and webhook delivery. EU-first.
- Identity & billing. Authentication / MFA and payment processing. Vendors chosen for PCI-DSS Level 1 + SOC 2 Type II evidence.
- AI providers. Foundation-model hosting for draft generation and classification. Zero data-retention contracts in place where the provider supports it.
- Discovery & enrichment. Court-validated public-web scraping, email-finding waterfall, address verification. EU-first where available.
- Observability. Error monitoring and product analytics with PII stripped or masked at the intake layer.
5. Contact
Questions about this list, the underlying DPAs, or any specific transfer mechanism go to privacy@leafer.io. We respond within one business day.
Related documents: the privacy policy, the Data Processing Addendum, and the full trust centre.
Stay informed
Get a 30-day notice before any sub-processor change.