Sub-processors
Last updated: 3 August 2026
To run LimeOrigin we rely on a limited set of vetted third-party services (“sub-processors”) that may process personal data on our behalf. We maintain data-processing terms with each and require appropriate security and transfer safeguards. This page lists them and what each is used for. See our GDPR statement and Privacy Policy for the wider context.
Core sub-processors
Used to operate the Service for every customer.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel | Application & website hosting, edge delivery/CDN, and DNS | USA / global edge |
| Supabase | Managed PostgreSQL database hosting (primary data store) | UK / EU region |
| Stripe | Payment processing, subscriptions and invoicing (card data held by Stripe, never by us) | USA / Ireland |
| Resend | Transactional email delivery (verification, notifications) | USA |
| PostHog | Product analytics — server-side, keyed to your organisation, sets no cookies | EU |
| Google Analytics | Website usage analytics for the LimeOrigin app — in-browser, cookies set only with the visitor's consent (Consent Mode); not used on customer-hosted sites | USA |
| Anthropic | AI processing (Claude) for blueprint, content and insights | USA |
| OpenAI | AI processing for selected generation tasks | USA |
Optional sub-processors
Engaged only when you choose to use the related feature — for example connecting a Google or Microsoft account, provisioning business email, or enabling AI-visibility sampling. If you don’t use the feature, the sub-processor isn’t involved.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft | Microsoft 365 email provisioning via Microsoft Graph; Azure AD sign-in for the connection; Bing Webmaster Tools metrics | USA / EU |
| Google Workspace email provisioning; Search Console & Business Profile metrics; Gemini for optional AI-visibility sampling | USA / EU | |
| Perplexity | Optional AI-assistant visibility sampling | USA |
International transfers
Where a sub-processor is outside the UK, transfers rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, alongside encryption in transit and at rest.
Changes & notice
We review this list as our stack evolves. When we add or replace a sub-processor that handles personal data, we’ll update this page and, for material changes, give reasonable notice so you can raise any objection. To be notified of changes, email privacy@limeorigin.com.