Subprocessors

Constitution §9. This page is generated from legal/subprocessors.yaml, so its history is the file’s history — publicly diffable, as promised. A party that does not appear here does not receive customer data.

Last updated 2026-08-26

Supabase

EU only

Supabase, Inc.

Purpose: Primary application database, authentication, and document storage.
Data: Account data, pipeline data, extracted fund data, uploaded documents.
Region: EU — eu-west-1 (Ireland)
Added: 2026-08-26

Data processing agreement →

Vercel

Transfers outside EU

Vercel, Inc.

Purpose: Application hosting and serverless compute.
Data: Request data in transit; no persistent customer storage.
Region: EU — fra1 (Frankfurt, Germany)
Added: 2026-08-26

Vercel is a US-incorporated processor. Compute and edge termination are pinned to the Frankfurt region, but platform operations and support access originate in the United States. Covered by Vercel's DPA incorporating EU Standard Contractual Clauses.

Data processing agreement →

Cloudflare

Transfers outside EU

Cloudflare, Inc.

Purpose: DNS, inbound email routing, raw message storage (R2), ingest queue, route cache (KV).
Data: Inbound email in raw RFC 822 form, retained 90 days; routing metadata.
Region: EU — R2 bucket created with EU jurisdiction restriction
Added: 2026-08-26

Email Routing terminates at the nearest edge, which for European senders is in the EU but is not contractually guaranteed to be. Raw message bodies are written only to the EU-jurisdiction R2 bucket. KV holds local-part routing metadata only — no message content, no personal data beyond the address itself.

Data processing agreement →

Anthropic

Zero retentionTransfers outside EU

Anthropic PBC

Purpose: Document extraction, classification, triage, and enrichment.
Data: Fund materials and email bodies submitted for extraction.
Region: EU inference where available; US otherwise
Added: 2026-08-26

Engaged under zero-retention terms — submitted content is not retained after the response is returned and is not used to train any model (Constitution §7).

Data processing agreement →

Resend

Transfers outside EU

Resend, Inc.

Purpose: Outbound transactional email — triage cards, declines, digests.
Data: Recipient address, message content of platform-generated mail.
Region: EU sending region
Added: 2026-08-26

US-incorporated processor with an EU sending region. Click tracking is disabled on all LP-facing mail, so no engagement data leaves the platform.

Data processing agreement →

Google

EU only

Google Ireland Limited

Purpose: Human staff mailboxes on lpgp.team. Receives human correspondence forwarded from lp.gp.
Data: Correspondence a customer sends to a named human at lp.gp.
Region: EU
Added: 2026-08-26

Not in the path of any product ingest. Mail addressed to a customer's own forwarding address never reaches Google.

Data processing agreement →