← Back to Trust & Security
Vendor and Transfer Register
Version: v2.1
Last updated: 14.07.2026
Next review: 01.10.2026
This register describes Lyyli's service providers in three tiers: (1) product subprocessors for contractual customers (Annex 5), (2) AI routes in the AI model register, and (3) controller-side vendors for Lyyli's own business (payments, CRM, internal Slack, marketing).
Product subprocessors
These providers process personal data on behalf of customer organisations to deliver the service. The contractual list for customers is in DPA Annex 5.
| Legal name | Service | Data categories | Primary storage | Other regions | Transfers | Usage | Verified |
|---|---|---|---|---|---|---|---|
| Clerk, Inc. | Authentication and identity management | User profiles, login metadata, organisation membership | US / global infrastructure [VARMENNETTAVA: Clerk instance region] | Global support, telemetry, and subprocessors; SCCs/DPF apply | SCCs, DPF where applicable | Required | 2026-07-14 |
| Vercel Inc. | Application hosting and edge infrastructure | Request logs, deployment metadata, function execution data | Function region: [VARMENNETTAVA: vercel.json / project settings] | US processing, global CDN and backups possible | SCCs, DPF where applicable | Required | 2026-07-14 |
| Supabase, Inc. | Database, file and object storage | Workspace content, attachments, metadata | Primary storage: [VARMENNETTAVA: Supabase project AWS region] | Support, logs, backups may involve other regions | SCCs where applicable | Required | 2026-07-14 |
| OpenRouter, Inc. | AI request routing to model providers | Prompts, responses, routing metadata | Default infrastructure US; EU in-region if Enterprise enabled [VARMENNETTAVA] | Underlying model providers (US/global) per route | SCCs, provider-specific terms | Required | 2026-07-14 |
| Resend, Inc. | Transactional email delivery | Email addresses, message metadata, delivery logs | Send region: [VARMENNETTAVA]; account/metadata/logs US | US account and metadata storage per Resend docs | SCCs, DPF where applicable | Required | 2026-07-14 |
| Recall.ai, Inc. | Meeting bots, recordings and transcription | Meeting audio, transcripts, participant metadata | eu-central-1 default [VARMENNETTAVA] | Downstream model providers route-dependent | SCCs where applicable | Optional | 2026-07-14 |
| Google LLC | Google Calendar integrations and model services where enabled | Calendar events, integration metadata, model prompts where used | EU or US depending on service and configuration | Global Google Cloud regions per product | SCCs, DPF where applicable | Optional | 2026-07-14 |
| Microsoft Corporation | Outlook and Microsoft calendar integrations | Calendar events, email metadata where integrated | EU/EEA where configured (e.g. Sweden) [VARMENNETTAVA] | Global Microsoft datacenters per tenant config | SCCs, DPF where applicable | Optional | 2026-07-14 |
AI routes
Model providers, routes, ZDR settings, and exceptions are documented in the separate AI model register.
Open AI model register →Controller-side vendors
These providers support Lyyli's own business operations and are not product subprocessors for customer workspace data.
| Provider | Service | Storage / processing | Mechanism | Verification |
|---|---|---|---|---|
| Stripe, Inc. | Payments, subscriptions, fraud and invoicing (Lyyli business) | International processing (US/EU) with SCCs/DPF | SCCs, DPF | verified |
| Slack Technologies, LLC | Internal team communication (Lyyli staff only) | Data residency per Slack plan [VARMENNETTAVA] | SCCs, DPF where applicable | partial |
| PostHog, Inc. | Marketing website analytics (EU cloud, consent-based) | EU (eu.i.posthog.com) | SCCs where applicable | verified |
| Usercentrics A/S | Cookie consent management (marketing site) | EU | SCCs where applicable | verified |
| Pipedrive OÜ | CRM and B2B sales pipeline (prospecting) | EU (vendor-dependent configuration) | SCCs where applicable | partial |