Sub-processor disclosure
Last updated 2026-10-13 · Effective from not yet in force
Draft disclosure. The list reflects the providers in the current build; entries marked “To be confirmed” are not yet contracted and process no Customer Content.
01About this list
This page lists the third parties that process personal data on our behalf (sub-processors) to provide the LexSalim website and Service, as referred to in the Privacy Policy and the Data Processing Agreement. Only providers evidenced in the current build and infrastructure are listed. Where a provider is marked “To be confirmed”, no Customer Content is sent to it until this page is updated and customers have been notified.
02Sub-processors
| Provider | Purpose | Data | Location | Status | Transfer mechanism |
|---|---|---|---|---|---|
| Cloudflare, Inc. | Edge network, DNS, TLS termination, traffic filtering, optional contact-form challenge | Connection and request metadata; website traffic | Global edge network; US company | In use (website) | To be confirmed |
| one.com (hosting provider) | Virtual servers hosting the website, application, database, document storage and backups | All Service data at rest | European Union | In use (website); application pending | EU/EEA hosting; no transfer |
| Mailgun (Sinch) | Transactional email: sign-in codes, security notices, invitations, contact-form delivery | Email address, message content (no document content) | EU region | Configured; sending not yet enabled | EU region; to be confirmed |
| Stripe | Subscription payments, invoices, customer billing portal | Name, email, billing address, payment method (held by Stripe), subscription status | US company with EU entities | Planned: added when checkout opens | To be confirmed |
| AI model provider(s) | Text extraction, summarisation, question answering and drafting on Customer Content when a member requests analysis | Customer Content submitted for analysis | To be confirmed | To be confirmed before launch; listed here before any Customer Content is processed | To be confirmed |
Review: complete legal entity names, contract references, data-residency options and transfer mechanisms for each provider before approval; name the AI model provider(s) only once contracts prohibiting training and limiting retention are signed
03Changes and objections
We give at least 30 days’ notice before adding or replacing a sub-processor by updating this page and emailing organisation administrators. Customers with a DPA may object on reasonable data-protection grounds within that period as set out in the DPA. To receive notifications or raise an objection, email [email protected].
04What is not a sub-processor
Public or licensed sources referenced by planned research features (for example legislation websites) do not receive personal data and are not sub-processors. Our professional advisers and authorities we are legally required to disclose to are recipients, not sub-processors.