1. About this list
Leafer code can engage the vendors listed below to deliver specific parts of the service. Vendor terms are linked below. Contract execution, transfer mechanism, runtime activation, and deployment region are verified separately for each customer environment; this page does not turn code reachability into a legal certification.
The list reflects current code reachability. A vendor must be evaluated against security posture, processing purpose, geographic location, and applicable contract terms before production activation.
2. Change notifications
Notice periods and objection rights come from each customer’s executed contract. This public inventory does not create a separate fixed notice period.
To receive change notifications, subscribe by emailing privacy@leafer.io with the subject line Subprocessor notifications. We keep the list confidential to subscribers.
3. Current sub-processors
Canonical code-backed inventory as of 3 September 2026:
| Vendor | Purpose | Use | Location | Terms |
|---|---|---|---|---|
| Vercel | Web hosting and edge runtime | Platform | Global | View |
| Railway | Application and database hosting | Platform | Configured deployment region | View |
| Clerk | Authentication, sessions, and MFA | Platform | Vendor-managed | View |
| Stripe | Billing and payment processing | Platform | Vendor-managed | View |
| Cloudflare | DNS, CDN, and network security | Platform | Global | View |
| Redis hosting provider | Queueing, caching, and rate limiting | Platform | Configured deployment region | View |
| OpenRouter | LLM gateway for classification and drafting | Platform | Vendor-managed | View |
| Resend | Transactional email and webhook handling | Platform | Vendor-managed | View |
| Apify | Public-web discovery and enrichment actors | Platform | Vendor-managed | View |
| Google Places discovery and consented Google Analytics | Platform | Global | View | |
| Meta | Consented advertising attribution through Pixel and Conversions API | Feature-dependent | Global | View |
| NeverBounce | Email-address verification | Feature-dependent | Vendor-managed | View |
| PostHog | First-party, memory-only product analytics | Feature-dependent | Configured analytics region | View |
| Sentry | Error and performance monitoring | Feature-dependent | Configured monitoring region | View |
| Unipile | Connected-account messaging integrations | Feature-dependent | France / configured region | View |
| HubSpot | Optional CRM synchronization | Feature-dependent | Vendor-managed | View |
| Salesforce | Optional CRM synchronization | Feature-dependent | Vendor-managed | View |
| Firecrawl | Optional website extraction | Feature-dependent | Vendor-managed | View |
| fal.ai | Optional generated media | Feature-dependent | Vendor-managed | View |
| Optional official public-signal read API | Feature-dependent | Vendor-managed | View | |
| XQuik | Optional X public-signal read API | Feature-dependent | Vendor-managed | View |
| IPRoyal | Optional residential proxy routing | Feature-dependent | Global | View |
4. Vendor categories
Sub-processors fall into six functional categories. Actual access controls, retention, transfer terms, and incident handling must be verified for each activated vendor.
- Infrastructure. Database, hosting, edge runtime, queueing, caching.
- Communications. Transactional email and webhook delivery.
- Identity & billing. Authentication / MFA and payment processing.
- AI providers. Foundation-model hosting for draft generation and classification. Retention terms depend on the activated provider contract.
- Discovery & enrichment. Public-web discovery, optional connected sources, website extraction, and address verification.
- Observability. Error monitoring and memory-only product analytics, subject to each integration’s configured data-minimisation controls.
5. Contact
Questions about this list, vendor terms, or any specific transfer mechanism go to privacy@leafer.io. We respond within one business day.
Related documents: the privacy policy, the Data Processing Addendum, and the full trust centre.
Stay informed
Request contract-specific sub-processor change notices.