← Back to Trust & Security
Vendor and Transfer Register
Version: v2.1
Last updated: 14.07.2026
Next review: 01.10.2026
This register describes Lyyli's service providers in three tiers: (1) product subprocessors for contractual customers (Annex 5), (2) AI routes in the AI model register, and (3) controller-side vendors for Lyyli's own business (payments, CRM, internal Slack, marketing).
Product subprocessors
These providers process personal data on behalf of customer organisations to deliver the service. The contractual list for customers is in DPA Annex 5.
| Legal name | Service | Data categories | Primary storage | Other regions | Transfers | Usage | Verified |
|---|---|---|---|---|---|---|---|
| Clerk, Inc. | Authentication and identity management | User profiles, login metadata, organisation membership | Global (Clerk does not offer a selectable region) | Global infrastructure, support, telemetry, and subprocessors; SCCs/DPF apply | SCCs, DPF where applicable | Required | 2026-08-07 |
| Vercel Inc. | Application hosting and edge infrastructure | Request logs, deployment metadata, function execution data | Function region: eu-north-1 (Stockholm) | Global CDN and backups may involve other regions; US processing possible for platform services | SCCs, DPF where applicable | Required | 2026-08-07 |
| Supabase, Inc. | Database, file and object storage | Workspace content, attachments, metadata | Primary storage: AWS eu-north-1 (Stockholm) | Support, logs, backups may involve other regions | SCCs where applicable | Required | 2026-08-07 |
| OpenRouter, Inc. | AI request routing to model providers | Prompts, responses, routing metadata | US for now | Underlying model providers (US/global) per route | SCCs, provider-specific terms | Required | 2026-08-07 |
| Resend, Inc. | Transactional email delivery | Email addresses, message metadata, delivery logs | Send region: eu-west-1 (Ireland) | Account/platform services may involve other regions per Resend documentation | SCCs, DPF where applicable | Required | 2026-08-07 |
| Recall.ai, Inc. | Meeting bots, recordings and transcription | Meeting audio, transcripts, participant metadata | eu-central-1 | Downstream model providers route-dependent | SCCs where applicable | Optional | 2026-08-07 |
| Google LLC | Google Calendar integrations and model services where enabled | Calendar events, integration metadata, model prompts where used | EU or US depending on service and configuration | Global Google Cloud regions per product | SCCs, DPF where applicable | Optional | 2026-07-14 |
| Microsoft Corporation | Outlook and Microsoft calendar integrations | Calendar events, email metadata where integrated | EU / Stockholm | Global Microsoft datacenters possible depending on service features | SCCs, DPF where applicable | Optional | 2026-08-07 |
AI routes
Model providers, routes, ZDR settings, and exceptions are documented in the separate AI model register.
Open AI model register →Controller-side vendors
These providers support Lyyli's own business operations and are not product subprocessors for customer workspace data.
| Provider | Service | Storage / processing | Mechanism | Verification |
|---|---|---|---|---|
| Stripe, Inc. | Payments, subscriptions, fraud and invoicing (Lyyli business) | International processing (US/EU) with SCCs/DPF | SCCs, DPF | verified |
| Slack Technologies, LLC | Internal team communication (Lyyli staff only) | Data residency per Slack plan [VARMENNETTAVA] | SCCs, DPF where applicable | partial |
| PostHog, Inc. | Marketing website analytics (EU cloud, consent-based) | EU (eu.i.posthog.com) | SCCs where applicable | verified |
| Usercentrics A/S | Cookie consent management (marketing site) | EU | SCCs where applicable | verified |
| Pipedrive OÜ | CRM and B2B sales pipeline (prospecting) | EU (vendor-dependent configuration) | SCCs where applicable | partial |