Trust
Subprocessors
The third parties we engage to run Lumenbase, and where each one processes data. Published for security questionnaires and customer due diligence.
Last updated: August 2026
Infrastructure
Always active as part of the core service.
| Provider | Purpose | Processing region |
|---|---|---|
| Supabase | Database, authentication, Edge Functions, file storage | EU (Ireland) |
| Railway | Application hosting, background workers, self-hosted search, encrypted backup volume | EU (Netherlands) and Singapore |
| Stripe | Payments, subscriptions, invoicing | Global (US and EU) |
| Resend | Transactional email: invitations, password resets, notifications | US |
| Sentry | Error and performance monitoring | Organization region (EU or US) |
| PostHog | Product analytics and session replay, consent-gated on the marketing site | EU |
| Google (Tag Manager, Analytics) | Marketing-site measurement, loaded only after analytics and marketing consent | Global |
| ip-api.com | Approximate IP geolocation for visit tracking and consent records | Global |
AI and enrichment
Active when a workspace uses AI features. Workspace admins can turn these off in settings.
| Provider | Purpose | Processing region |
|---|---|---|
| Mistral AI | Language models for Lumo, enrichment and drafting, plus speech-to-text for meeting recordings | EU (France) |
| Anthropic | Language models for Lumo and meeting intelligence when a Claude model is selected | US |
| Serper | Web-search fallback for enrichment research, used only when our own search returns nothing | US |
What is not on this list
- Self-hosted components. Our search index runs on our own Railway service. Railway is the subprocessor; the software on it is not a third party.
- Services you connect. Google Workspace, Microsoft 365, Slack, Pipedrive, HubSpot, Attio and the other integrations are authorized by you and hold their relationship with you, not with us. They are your processors, and they differ per workspace.
Changes to this list
We give reasonable advance notice before a new subprocessor starts processing your data, and you may object on data-protection grounds. See section 11 of the Data Processing Agreement.
Questions: security@lumenbase.io · Privacy Policy · Trust & Security · Security disclosure