Sub-processors

Lacuna uses the sub-processors below to deliver the service. Each entry lists what data the sub-processor sees, the region in which it is processed, and whether a signed DPA + Standard Contractual Clauses agreement is in place. Entries marked DPA pending will be signed before public signup opens.

• Cloudflare R2

  DPA pending

  Object storage for uploaded and redacted PDFs.

  Data

  PDF bytes only — not extracted text or detected spans.

  Region

  US East default; EU region-pinned bucket on Enterprise.

• Supabase

  DPA pending

  Postgres database and pgmq job queue.

  Data

  Job metadata, user IDs, filename / email columns, audit-log entries. No PDF content.

  Region

  US East.

• Fly.io

  DPA pending

  Compute hosting for the API service and worker pool.

  Data

  Request payloads in flight (uploaded PDF bytes during the redact endpoint window); structured logs (no PII — scrubbed at the boundary).

  Region

  US East (iad).

• Stripe

  DPA pending

  Payment processing and subscription management.

  Data

  Billing email, payment method, billing address.

  Region

  US (Stripe global).

• Resend

  DPA pending

  Transactional email (job completion, password reset).

  Data

  User email and dashboard URLs. No PDF content.

  Region

  US.

• Clerk

  DPA pending

  User authentication and session management.

  Data

  Identity (email, name) and session data.

  Region

  US.

• Sentry

  DPA pending

  Application error monitoring and cron-job health checks.

  Data

  Request ID, organisation ID, tier, route, error class name, and a HMAC-pseudonymised user ID. PII (emails, SSNs, credit cards, filenames) is scrubbed before transmission. No PDF content. The user-ID HMAC secret can be rotated to cryptographically sever historical events from a deleted user.

  Region

  US.

Note what is not on this list: an AI provider. Both detection passes — the pattern engine and the AI model — run on Lacuna-operated workers (the Fly.io entry above); page text is not transmitted to any third-party AI service. Enterprise customers who bring their own LLM key as an additional detection layer establish their own direct relationship with that provider, governed by their individual contract — we will list any such processor in that customer's DPA.