Authorised sub-processors
The current list of sub-processors that process data on behalf of Leadgram under GDPR Art. 28(2). This page is kept up to date; changes are notified at least 14 days in advance.
Last updated: May 2026
| Sub-processor | Service | Location | Transfer mechanism | DPA / Policy |
|---|---|---|---|---|
| Neon (AWS eu-west-2) | PostgreSQL database | United Kingdom — London (third country) | EU–UK adequacy decision (GDPR Art. 45) | Verify → |
| OpenAI | AI conversation processing | USA (third country) | SCC (Decision 2021/914, Module 2) + DPA + TIA + supplementary measures (TLS, data minimisation) | Verify → |
| Clerk | User authentication | USA / EU (third country / EEA) | SCC + EU-US DPF (ONLY if listed on dataprivacyframework.gov/list; otherwise SCC+TIA) | Verify → |
| Resend | Email delivery | USA (third country) | SCC (Decision 2021/914) + DPA | Verify → |
Change procedure
Leadgram notifies customers (Controllers) at least 14 calendar days before adding or replacing a sub-processor. The Controller may object in writing within 14 days with substantiated reasons. If there is a substantiated objection without an alternative: the parties seek a solution or the Controller may terminate with 30 days’ notice, without penalties.