← Back to Trust & Security
Vendor and Transfer Register
Version: v2.2
Last updated: 17.08.2026
Next review: 01.10.2026
This register describes Lyyli's service providers in three tiers: (1) product subprocessors for contractual customers (Annex 5), (2) AI routes in the AI model register, and (3) controller-side vendors for Lyyli's own business (payments, CRM, internal Slack, marketing).
Product subprocessors
These providers process personal data on behalf of customer organisations to deliver the service. The contractual list for customers is in DPA Annex 5.
| Legal name | Service | Data categories | Primary storage | Other regions | Transfers | Usage | Verified |
|---|---|---|---|---|---|---|---|
| Clerk, Inc. | Authentication and identity management | User profiles, login metadata, organisation membership | Global (Clerk does not offer a selectable region) | Global infrastructure, support, telemetry, and subprocessors; SCCs/DPF apply | SCCs, DPF where applicable | Required | 2026-08-07 |
| Vercel Inc. | Application hosting and edge infrastructure | Request logs, deployment metadata, function execution data | Function region: eu-north-1 (Stockholm) | Global CDN and backups may involve other regions; US processing possible for platform services | SCCs, DPF where applicable | Required | 2026-08-07 |
| Supabase, Inc. | Database, file and object storage | Workspace content, attachments, metadata | Primary storage: AWS eu-north-1 (Stockholm) | Support, logs, backups may involve other regions | SCCs where applicable | Required | 2026-08-07 |
| Vercel Inc. | AI Gateway: routing language-model requests to Anthropic, Google Vertex AI, and OpenAI | Prompts, responses, routing metadata | Model-specific (Claude/Gemini EU; GPT Global); region auditable in logs | Underlying model providers per AI model register | SCCs, DPF where applicable; model-provider terms | Required | 2026-08-17 |
| OpenAI, LLC | GPT language-model inference (GPT-5.6 Luna, Terra, Sol) | Prompts and model responses | Global (cannot currently be limited to the EU only) | OpenAI global infrastructure | SCCs, DPF where applicable | Required | 2026-08-17 |
| Anthropic PBC | Claude language-model inference (Sonnet 5, Opus 5, Fable 5) | Prompts and model responses | EU (inference locked to the EU) | None for language-model inference | SCCs where applicable; EU processing | Required | 2026-08-17 |
| Google LLC | Vertex AI Gemini language-model inference (3.5 Flash Lite, 3.7 Flash, 3.5 Flash) | Prompts and model responses | EU (inference locked to the EU) | None for Gemini inference | SCCs, DPF where applicable; Google Cloud CDPA + Service Specific Terms | Required | 2026-08-17 |
| Resend, Inc. | Transactional email delivery | Email addresses, message metadata, delivery logs | Send region: eu-west-1 (Ireland) | Account/platform services may involve other regions per Resend documentation | SCCs, DPF where applicable | Required | 2026-08-07 |
| Recall.ai, Inc. | Meeting bots, recordings and transcription | Meeting audio, transcripts, participant metadata | eu-central-1 | Downstream model providers route-dependent | SCCs where applicable | Optional | 2026-08-07 |
| Google LLC | Google Calendar integrations where enabled | Calendar events and integration metadata | EU or US depending on Google Workspace configuration | Global Google Cloud regions per product | SCCs, DPF where applicable | Optional | 2026-08-17 |
| Microsoft Corporation | Outlook and Microsoft calendar integrations | Calendar events, email metadata where integrated | EU / Stockholm | Global Microsoft datacenters possible depending on service features | SCCs, DPF where applicable | Optional | 2026-08-07 |
AI routes
Model providers, routes, ZDR settings, and exceptions are documented in the separate AI model register.
Open AI model register →Controller-side vendors
These providers support Lyyli's own business operations and are not product subprocessors for customer workspace data.
| Provider | Service | Storage / processing | Mechanism | Verification |
|---|---|---|---|---|
| Stripe, Inc. | Payments, subscriptions, fraud and invoicing (Lyyli business) | International processing (US/EU) with SCCs/DPF | SCCs, DPF | verified |
| Slack Technologies, LLC | Internal team communication (Lyyli staff only) | Data residency per Slack plan [VARMENNETTAVA] | SCCs, DPF where applicable | partial |
| PostHog, Inc. | Marketing website analytics (EU cloud, consent-based) | EU (eu.i.posthog.com) | SCCs where applicable | verified |
| Usercentrics A/S | Cookie consent management (marketing site) | EU | SCCs where applicable | verified |
| Pipedrive OÜ | CRM and B2B sales pipeline (prospecting) | EU (vendor-dependent configuration) | SCCs where applicable | partial |