1. Purpose of this list
When Lytheron OÜ processes personal data for a customer, it may entrust technical activities to specialised providers. These parties act as subprocessors insofar as they process customer data on Lytheron's instructions. Some providers, particularly payment providers, may also act as independent controllers for legally required or service-specific purposes.
2. Principal providers
Vercel Inc.
Service: Application hosting, edge delivery, server functions and platform protection.
Data and categories: Technical data, web requests, logs and content needed to distribute the application.
Location and transfers: Configured regions and global infrastructure; possible processing in the United States and other countries with applicable contractual safeguards.
Supabase (contracting entity under the applicable agreement)
Service: PostgreSQL database, authentication, storage and managed backend services.
Data and categories: Accounts, organisations, roles, content, files, responses, logs and application metadata.
Location and transfers: The project region configured by the Lytheron customer; support and sub-providers may involve safeguarded transfers.
Stripe Payments Europe, Limited and applicable Stripe entities
Service: Checkout, subscriptions, payments, fraud prevention and billing portal.
Data and categories: Payer details, payment references, subscription status, tax and anti-fraud information.
Location and transfers: European Economic Area and Stripe's global infrastructure with applicable transfer mechanisms.
Plus Five Five, Inc. (Resend)
Service: Delivery of transactional and operational email.
Data and categories: Email address, name or organisation where present, message content, delivery status and technical metadata.
Location and transfers: United States and subprocessors declared by Resend, with safeguards provided by its DPA.
3. Roles and data actually processed
Inclusion does not mean every provider processes all data or is used for every customer. Processing depends on activated products, features used, configured technical region and the applicable payment or communication route.
Lytheron limits shared data to what is necessary for the delegated function and configures providers using least privilege and reasonable available settings.
4. Contracts and safeguards
Lytheron uses terms of service, data processing agreements and transfer mechanisms supplied by providers and appropriate to the active contractual plan. Before public launch and when the plan changes, Lytheron checks that purchased terms support the intended processing.
Where required, international transfers rely on adequacy decisions, the Data Privacy Framework, standard contractual clauses or other safeguards recognised by applicable law.
5. New providers and changes
Lytheron may add, replace or remove providers for technical development, security, availability or commercial requirements. Material changes are published here and, where reasonably possible, before actual use for customer data.
A customer subject to the Data Processing Addendum may raise a reasoned data-protection objection within fifteen days of publication or notification, by writing to legal@lytheron.com.
6. Providers not included
The list does not include as subprocessors providers that do not process customer personal data, internal development tools used without production data, confidentiality-bound advisers receiving data only in specific cases, or services activated and controlled directly by the customer.
7. Related documents
See also the Privacy notice, Data Processing Addendum and Security page.
Supabase infrastructure attestations
Supabase states that it holds ISO/IEC 27001:2022 certification and a SOC 2 Type 2 report within its own control scope. These attestations concern the provider; they do not certify Lytheron OÜ, application code, configuration or the complete Lytheron Cloud service. See Supabase Security. Access to the certificate and report is subject to provider terms. These attestations do not establish an uptime commitment, recovery time or exclusively European data residency for Lytheron Cloud.
Lytheron remains responsible for application controls and configurations within its remit. The provider DPA does not replace the DPA between Lytheron and its customer.
Contact and document version
For legal, privacy, security or contractual requests, write to legal@lytheron.com. The version published at this address applies from the date shown at the beginning, unless specific conditions are agreed in writing.