Subprocessors

Lotics relies on a small number of third-party providers ("subprocessors") to operate its service. Each processes customer data only as needed to deliver the product, over encrypted connections, and is held to data-protection obligations consistent with those we owe you.

Current subprocessors

Render
Singapore
What it processes
All customer data stored in the service
Purpose
Application hosting, managed PostgreSQL database, managed cache, encrypted backups
Cloudflare
Asia-Pacific (object storage); global edge network
What it processes
Uploaded files, deployed app bundles, network traffic metadata
Purpose
Private object storage, file delivery, app hosting, live updates, isolated sandboxes for code the assistant runs, DNS
Anthropic
United States
What it processes
The prompt and any document an AI feature reads, in transit
Purpose
AI features: the assistant, document extraction, and workflow steps that call a model. Under its commercial API terms your content is not used to train models and is retained for no more than 30 days
OpenAI
United States
What it processes
The text prompt you write, in transit
Purpose
Image generation
AssemblyAI
United States
What it processes
Audio and transcript text, in transit
Purpose
Voice transcription
Resend
United States
What it processes
Recipient address and message content
Purpose
Transactional email: sign-in, invitations, notifications
PostHog
United States
What it processes
Usage events, request metadata and error reports, as counts and identifiers only
Purpose
Product analytics, error tracking, application logs
Google Cloud
United States
What it processes
Change notifications for a Gmail mailbox you connected: the mailbox address and a change marker, never message content
Purpose
Delivering Gmail triggers to your workflows
VietQR
Vietnam
What it processes
The tax code you look up, in transit
Purpose
Business registry lookup when you enter a company's tax code

How your data is protected

In transit: all traffic to subprocessors is encrypted with TLS.
At rest: customer data held by our infrastructure providers is encrypted at rest.
Connected-account credentials: when you connect a third-party account, those credentials are additionally encrypted at the application layer before they are stored.
Telemetry: the events and logs we send to PostHog carry counts, identifiers and request metadata, never the content of a record, a document or a message. We do not record user sessions.
Each subprocessor is engaged only for the purpose listed above.

Where your data is processed

Lotics runs its application and database on Render in Singapore. Files are stored in Cloudflare object storage in the Asia-Pacific region. The other subprocessors operate from the locations shown against each. Data does not rest in Vietnam under the standard service; a private instance hosted in Vietnam is available as a separate offer.

Changes to this list

We give at least 30 days' notice before engaging or replacing a subprocessor that processes your data. You may object on data-protection grounds, and if we cannot resolve the objection within 30 days you may terminate the service. To be notified of changes, contact us at [email protected].

Change log

5 September 2026 — Google Cloud added (delivery of Gmail triggers) and VietQR added (business registry lookup by tax code). Cloudflare's entry now names app hosting, live updates and the assistant's sandboxes. Anthropic's retention stated as a period. Services you connect under your own account are no longer listed: they are not subprocessors. Telemetry limits and the notice period stated.
26 July 2026 — First publication.

Last updated: 5 September 2026.