Subprocessors

Vendors that process customer data on our behalf to operate Laureo. Each entry lists what the vendor does for us, the categories of data they touch, where the processing happens, and a link to their Data Processing Addendum (DPA) where available.

Last updated 7/17/2026. Machine-readable JSON for procurement teams: /api/legal/subprocessors.

NamePurposeData categoriesRegionDPA
Vercel Inc.Application hosting and edge compute
  • CRM data in-flight (no storage)
United States (us-west-2 / pdx1)DPA
Supabase Inc.Database, authentication, file storage
  • All CRM data at rest
  • Auth identities
  • Uploaded files
United StatesDPA
Upstash Inc.Redis cache, QStash background jobs
  • Cache fragments
  • Background-job payloads
United StatesDPA
OpenRouterAI inference gateway
  • AI prompts and completions (ZDR enforced)
United StatesDPA
Anthropic PBCAI inference (downstream of OpenRouter, ZDR)
  • AI prompts and completions (ZDR enforced)
United StatesDPA
OpenAI Inc.AI inference (downstream of OpenRouter, ZDR)
  • AI prompts and completions (ZDR enforced)
United StatesDPA
Cloudmersive Inc.Antivirus scanning of uploaded files
  • File bytes in-memory only
United States·
Stripe Inc.Payment processing for CRM subscription billing
  • Billing contact
  • Payment method
United StatesDPA
Google LLCPub/Sub for Gmail push notifications
  • Pub/Sub notification metadata
United StatesDPA
Zoom Video Communications Inc.OAuth-based Zoom meeting scheduling and cloud recording metadata sync (per-rep, when the rep connects their Zoom account)
  • OAuth tokens
  • Zoom user identifier
  • Zoom account identifier
  • meeting metadata
  • recording metadata (playback URL only)
United StatesDPA
Microsoft Corp.Graph API for Outlook push notifications
  • Webhook notification metadata
United StatesDPA
Amazon Web Services Inc.Transactional email delivery (SES)
  • Recipient email
  • Email body
United States (us-east-2)DPA
reCAPTCHA Enterprise (Google)Bot detection on public forms
  • IP address
  • Browser fingerprint
United StatesDPA
ZeroBounceEmail-address deliverability verification for cold-outreach lead lists
  • Recipient email address (verification request only)
United StatesDPA
IcypeasContact-data enrichment (work-email finding, person and company data)
  • Contact name
  • Work email
  • Job title
  • Company data
European Union (France)·
TrestlePhone-number identity resolution (phone reveals)
  • Contact name
  • Phone number
  • Identity attributes
United States·

Change notifications

When we add, remove, or materially change a subprocessor we notify customer primary contacts via email and publish the change here. Customers who require advance notice for procurement review can contact us to subscribe to a dedicated notification list.