For each sub-processor that Uncle Louis engages, Uncle Louis applies the principle of least privilege: each third-party system shall only have access to the minimum Personal Data necessary to fulfil its purpose. Uncle Louis processes Personal Data within the EU/EEA by default. Where a sub-processor is headquartered outside the EU/EEA, Uncle Louis relies on the Standard Contractual Clauses (Module 3, processor-to-processor) as the transfer mechanism, with supplementary measures where necessary.

This list is the canonical Annex 2 to the Uncle Louis Data Processing Agreement and mirrors the in-app Trust Center (Admin → Company → Trust Center).

  • Vercel

    Purpose
    Hosting, edge network, and deployment of the web application and serverless functions
    Data categories processed
    HTTP request logs, user IP addresses, deployment metadata, Subscriber Content in transit
    Data residency
    EU/EEA (Frankfurt) for inference and edge requests; US for some platform metadata
    Legal entity
    Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States

  • Supabase

    Purpose
    Managed PostgreSQL database, authentication, and object storage
    Data categories processed
    Account data, authentication data, Subscriber Content (chat threads, memoranda, uploaded documents), technical data, support data
    Data residency
    EU/EEA (Frankfurt)
    Legal entity
    Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992

  • Fly.io

    Purpose
    Hosting of the asynchronous background worker (document processing, email sync, citation jobs)
    Data categories processed
    Worker logs and job payload metadata; Subscriber Content in transit during job execution
    Data residency
    EU/EEA (Amsterdam, ams region)
    Legal entity
    Fly.io Inc., 1735 Broadway St, Oakland, CA 94612, United States

  • OpenRouter

    Purpose
    Large language model gateway for AI chat and memorandum generation
    Data categories processed
    Chat prompts, document excerpts submitted as Input, and generated Output, to the extent they contain Personal Data
    Data residency
    US, with model providers routed within the EU/EEA where available
    Legal entity
    OpenRouter Inc., United States

  • GitHub

    Purpose
    Source code hosting, continuous integration, and build pipelines
    Data categories processed
    Incidental Personal Data contained in source code, build logs, and CI environment variables; not the production Subscriber Content store
    Data residency
    US
    Legal entity
    GitHub, Inc., 88 Colin P Kelly Jr St, San Francisco, CA 94107, United States

  • Braintrust

    Purpose
    Large language model observability for AI quality monitoring, evaluation, and feedback
    Data categories processed
    AI traces (prompts, model responses, tool calls, latency and cost metrics) and user-submitted feedback events, to the extent they contain Personal Data
    Data residency
    US
    Legal entity
    Braintrust Data, Inc., United States

Uncle Louis does not authorise OpenRouter or its upstream model providers to use Subscriber Content to train generative or base AI models. Uncle Louis maintains an up-to-date list of sub-processors on the in-application Trust Center and on the public website. Changes to the list are notified to Subscriber administrators in accordance with Clause 4.2 of the DPA.

For questions about this list or to object to a new sub-processor, contact antony@unclelouis.ai.