Subprocessors
Lotics relies on a small number of third-party providers ("subprocessors") to operate its service. Each processes customer data only as needed to deliver the product, over encrypted connections, and is held to data-protection obligations consistent with those we owe you.
Current subprocessors
| Provider | Location | What it processes | Purpose |
|---|---|---|---|
| Render | Singapore | All customer data stored in the service | Application hosting, managed PostgreSQL database, managed cache, encrypted backups |
| Cloudflare | Asia-Pacific (object storage); global edge network | Uploaded files, deployed app bundles, network traffic metadata | Private object storage, file delivery, app hosting, live updates, isolated sandboxes for code the assistant runs, DNS |
| Anthropic | United States | The prompt and any document an AI feature reads, in transit | AI features: the assistant, document extraction, and workflow steps that call a model. Under its commercial API terms your content is not used to train models and is retained for no more than 30 days |
| OpenAI | United States | The text prompt you write, in transit | Image generation |
| AssemblyAI | United States | Audio and transcript text, in transit | Voice transcription |
| Resend | United States | Recipient address and message content | Transactional email: sign-in, invitations, notifications |
| PostHog | United States | Usage events, request metadata and error reports, as counts and identifiers only | Product analytics, error tracking, application logs |
| Google Cloud | United States | Change notifications for a Gmail mailbox you connected: the mailbox address and a change marker, never message content | Delivering Gmail triggers to your workflows |
| VietQR | Vietnam | The tax code you look up, in transit | Business registry lookup when you enter a company's tax code |
How your data is protected
- In transit: all traffic to subprocessors is encrypted with TLS.
- At rest: customer data held by our infrastructure providers is encrypted at rest.
- Connected-account credentials: when you connect a third-party account, those credentials are additionally encrypted at the application layer before they are stored.
- Telemetry: the events and logs we send to PostHog carry counts, identifiers and request metadata, never the content of a record, a document or a message. We do not record user sessions.
- Each subprocessor is engaged only for the purpose listed above.
Where your data is processed
Lotics runs its application and database on Render in Singapore. Files are stored in Cloudflare object storage in the Asia-Pacific region. The other subprocessors operate from the locations shown against each. Data does not rest in Vietnam under the standard service; a private instance hosted in Vietnam is available as a separate offer.
Changes to this list
We give at least 30 days' notice before engaging or replacing a subprocessor that processes your data. You may object on data-protection grounds, and if we cannot resolve the objection within 30 days you may terminate the service. To be notified of changes, contact us at [email protected].
Change log
- 5 September 2026 — Google Cloud added (delivery of Gmail triggers) and VietQR added (business registry lookup by tax code). Cloudflare's entry now names app hosting, live updates and the assistant's sandboxes. Anthropic's retention stated as a period. Services you connect under your own account are no longer listed: they are not subprocessors. Telemetry limits and the notice period stated.
- 26 July 2026 — First publication.
Last updated: 5 September 2026.