Lyyli.ai - Viestinnän hallintajärjestelmäLyyli
Back to list
Annexes

ANNEX 5 – Subprocessor List

Open print view
Version v2.3Last updated 17.08.2026Next review 01.10.2026Contractually binding

Owner: CTO · Approver: CEO

This annex lists technical subprocessors for the Lyyli product that process personal data on behalf of customer organisations to deliver the service. Controller-side vendors (payments, CRM, internal Slack, marketing analytics) are described in the privacy notice. Language-model inference subprocessors are listed in this annex; model-level detail is in the Trust Center AI model register. Changes are notified at least 30 days in advance; customer organisations may object to material changes under the DPA.

LEGAL NAMESERVICEROLEDATA CATEGORIESPRIMARY STORAGE REGIONOTHER PROCESSING REGIONSTRANSFER MECHANISMUSAGE STATUSLAST VERIFIED
ClerkAuthentication and identity managementSubprocessorUser profiles, login metadata, organisation membershipGlobal (Clerk does not offer a selectable region)Global infrastructure, support, telemetry, and subprocessors; SCCs/DPF applySCCs, DPF where applicableRequired2026-08-07
Vercel Inc.Application hosting and edge infrastructureSubprocessorRequest logs, deployment metadata, function execution dataFunction region: eu-north-1 (Stockholm)Global CDN and backups may involve other regions; US processing possible for platform servicesSCCs, DPF where applicableRequired2026-08-07
SupabaseDatabase, file and object storageSubprocessorWorkspace content, attachments, metadataPrimary storage: AWS eu-north-1 (Stockholm)Support, logs, backups may involve other regionsSCCs where applicableRequired2026-08-07
Vercel Inc.AI Gateway: routing language-model requests to Anthropic, Google Vertex AI, and OpenAISubprocessorPrompts, responses, routing metadataModel-specific (Claude/Gemini EU; GPT Global); region auditable in logsUnderlying model providers per AI model registerSCCs, DPF where applicable; model-provider termsRequired2026-08-17
OpenAIGPT language-model inference (GPT-5.6 Luna, Terra, Sol)SubprocessorPrompts and model responsesGlobal (cannot currently be limited to the EU only)OpenAI global infrastructureSCCs, DPF where applicableRequired2026-08-17
Anthropic PBCClaude language-model inference (Sonnet 5, Opus 5, Fable 5)SubprocessorPrompts and model responsesEU (inference locked to the EU)None for language-model inferenceSCCs where applicable; EU processingRequired2026-08-17
Google LLCVertex AI Gemini language-model inference (3.5 Flash Lite, 3.7 Flash, 3.5 Flash)SubprocessorPrompts and model responsesEU (inference locked to the EU)None for Gemini inferenceSCCs, DPF where applicable; Google Cloud CDPA + Service Specific TermsRequired2026-08-17
ResendTransactional email deliverySubprocessorEmail addresses, message metadata, delivery logsSend region: eu-west-1 (Ireland)Account/platform services may involve other regions per Resend documentationSCCs, DPF where applicableRequired2026-08-07
Recall.aiMeeting bots, recordings and transcriptionSubprocessorMeeting audio, transcripts, participant metadataeu-central-1Downstream model providers route-dependentSCCs where applicableOptional (integration)2026-08-07
Google LLCGoogle Calendar integrations where enabledSubprocessorCalendar events and integration metadataEU or US depending on Google Workspace configurationGlobal Google Cloud regions per productSCCs, DPF where applicableOptional (integration)2026-08-17
Microsoft CorporationOutlook and Microsoft calendar integrationsSubprocessorCalendar events, email metadata where integratedEU / StockholmGlobal Microsoft datacenters possible depending on service featuresSCCs, DPF where applicableOptional (integration)2026-08-07

Changes are notified at least 30 days in advance. The customer organisation acts as controller to the extent it determines the purposes and means of processing customer content. An extended vendor register is available in the Trust Center.

Version history