Legal

Sub-processors

These are the only vendors that may process customer data on our behalf. We give 30 days' notice before adding a new one.

Subscribe to change notices

Infrastructure

Core hosting, storage and networking for the Loreflow platform.

  • Cloud hosting & database — application hosting · EU / US
  • Object storage — encrypted artifact cache · EU / US
  • CDN & DDoS protection — static asset delivery · Global edge

AI processing

Model providers used for recall, summarisation and insight generation. All are contractually barred from training on customer data, and Enterprise workspaces can bring their own key or use a private deployment.

  • Managed inference gateway — recall & summarisation · US
  • Embedding provider — semantic search index · EU

Operations

Vendors that support billing, communication and product analytics. None receive workspace content.

  • Payments processor — subscription billing · US / EU
  • Transactional email — product notifications · EU
  • Error monitoring — crash and exception traces · EU

Change notices

Any addition or replacement is published here first, then emailed to every workspace admin. You may object in writing during the notice period.

FAQ

About subprocessors.

Who else touches the data.

Open the live demo

Only for hosting, storage and infrastructure. Each one is listed with its purpose and processing region.

Yes. New subprocessors are announced before they begin processing, leaving time to object.

No human at a subprocessor has application-level access; data is encrypted and scoped to infrastructure duties.