Sub-processors
Third-party services that may process tenant data. We post material changes here 30 days before they take effect.
This list reflects the live + planned production stack. Services marked planned are part of the M-Deploy / M-Outlook roadmap and are not yet production-active.
| Service | Purpose | Region | Status |
|---|---|---|---|
| Anthropic | AI inference for tenants on the managed "Limena AI" tier (Claude API). | United States | Live |
| Vercel | Hosting for the Next.js frontend at limena.io. | Global edge (CDN) | Planned |
| Fly.io | Hosting for the FastAPI backend and ARQ worker. | London Heathrow (lhr) | Planned |
| Managed PostgreSQL provider | Primary application database. Provider locks at M-Deploy open (Q1). | EU (London) | Planned |
| Upstash | Redis cache + ARQ job queue + rate-limit + AI quota counters. | EU | Planned |
| System email transport (Resend or AWS SES) | Outbound system mail — invitations, password resets, demo-request notifications. NOT outbound tenant campaigns (those route through your connected Gmail or Microsoft 365 account). | Provider-dependent | Planned |
| Error tracking (Sentry or equivalent) | Backend + frontend exception capture. Tenant data is never intentionally sent; URL paths, stack traces, and request IDs only. | Provider-dependent | Planned |
| Google (Gmail API) | Only for tenants who connect a Gmail or Workspace account via OAuth. Limena reads + sends on the connected mailbox. | Provider-dependent | Live |
| Microsoft (Graph API) | Only for tenants who connect a Microsoft 365 account via OAuth. Lands at M-Outlook. | Provider-dependent | Planned |
Materially new sub-processors — meaning a new third party that will process tenant data beyond what these existing categories cover — are announced here at least 30 days before going live, except where they are a like-for-like replacement of an existing entry.