Pre-approved Sub-processors

Last updated: 28 May 2026.

For each sub-processor that Uncle Louis engages, Uncle Louis applies the principle of least privilege: each third-party system shall only have access to the minimum Personal Data necessary to fulfil its purpose.

(1) Vercel — Hosting, edge network, and deployment of the web application and serverless functions. Personal Data processed: HTTP request logs, user IP addresses, deployment metadata, and Subscriber Content in transit. Data residency: EU/EEA (Frankfurt) for inference and edge requests; US for some platform metadata. Legal entity: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States. Transfer mechanism: Standard Contractual Clauses incorporated into Vercel's Data Processing Addendum.

(2) Supabase — Managed PostgreSQL database, authentication, and object storage. Personal Data processed: all categories listed in A1.5(a)–(d) and (f). Data residency: EU/EEA (Frankfurt region). Legal entity: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Transfer mechanism: Standard Contractual Clauses incorporated into Supabase's Data Processing Addendum.

(3) Fly.io — Hosting of the asynchronous background worker (document processing, email sync, citation jobs). Personal Data processed: worker logs and job payload metadata; Subscriber Content in transit during job execution. Data residency: EU/EEA (Amsterdam, ams region). Legal entity: Fly.io Inc., 1735 Broadway St, Oakland, CA 94612, United States. Transfer mechanism: Standard Contractual Clauses incorporated into Fly.io's Data Processing Addendum.

(4) OpenRouter — Large language model gateway for AI chat and memorandum generation. Personal Data processed: chat prompts, document excerpts submitted as Input, and generated Output, in each case to the extent they contain Personal Data. Data residency: US, with model providers routed within the EU/EEA where available. Legal entity: OpenRouter Inc., United States. Transfer mechanism: Standard Contractual Clauses incorporated by reference via OpenRouter Terms of Service (section 9.2). Uncle Louis does not authorise OpenRouter or its upstream model providers to use Subscriber Content to train generative or base AI models.

(5) GitHub — Source code hosting, continuous integration, and build pipelines. Personal Data processed: incidental Personal Data contained in source code, build logs, and CI environment variables; not the production Subscriber Content store. Data residency: US. Legal entity: GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, United States. Transfer mechanism: Standard Contractual Clauses incorporated into GitHub's Data Protection Agreement.

(6) Braintrust — Large language model observability for AI quality monitoring, evaluation, and feedback. Personal Data processed: AI traces (prompts, model responses, tool calls, latency and cost metrics) and user-submitted feedback events, to the extent they contain Personal Data. Data residency: US. Legal entity: Braintrust Data, Inc., United States. Transfer mechanism: Standard Contractual Clauses incorporated into Braintrust's Data Processing Addendum.

Uncle Louis maintains an up-to-date list of sub-processors on the in-application Trust Center (Admin → Company → Trust Center) and on the public website. Changes to the list are notified to Subscriber administrators in accordance with Clause 4.2 of this DPA.

End of Annexes.