Sub-processors & Service Providers
Last updated: 2026-08-19
This page lists the third parties involved in delivering Lexabit, in three categories that reflect how each one actually touches data. We list deliberately inclusively — where there is any realistic path for customer personal data to reach a vendor, we would rather disclose it than argue it away.
Sub-processors
Sub-processors are third parties that process customer personal data on Lexabit's behalf, engaged under GDPR Article 28, as part of delivering or supporting the service. Each processes data only to the extent needed for its stated function.
| Provider | Purpose | Data categories | Region | Status |
|---|---|---|---|---|
 DigitalOcean, LLC | Cloud infrastructure hosting (servers, database, object storage, CDN) | All platform data | Amsterdam, Netherlands (EU) | Active |
 Railsware Products Studio LLC | Mailtrap — outbound transactional email delivery | Email addresses and notification content | EU/US (provider-operated) | Active |
 Google Cloud EMEA Limited | Google Workspace — internal business email and customer support correspondence (Google Cloud EMEA Limited is Google's EMEA contracting entity for Workspace) | Correspondence with customer staff | EU/US (provider-operated) | Active |
| Functional Software, Inc. (Sentry) | Error tracking and debugging — reserved for future integration; will receive error/diagnostic data if introduced | None today — not integrated | EU/US (provider-operated) | Planned |
A Planned row means the provider is named in our Data Processing Agreement's approved list ahead of use — part of future-proofing the approved list — but is not integrated and receives no data today. It will move to Active here before any data flows to it.
Service providers
Operational tools we use to run the company. They are not engaged to process customer data, and no customer data is shared with them by design — but day-to-day work (support coordination, issue tracking) means customer personal data may incidentally appear in them, for example in a support ticket that quotes a customer email. We list them for exactly that reason.
| Provider | Purpose | Exposure | Region |
|---|---|---|---|
| Slack Technologies, LLC (Salesforce) | Internal team communication | Incidental — customer context may be referenced in internal discussion | EU/US (provider-operated) |
| Linear Orbit, Inc. | Issue tracking and development planning | Incidental — tickets may reference customer context | EU/US (provider-operated) |
Slack also appears in the Data Processing Agreement's approved sub-processor list — it is included there for completeness under the same over-inclusive principle as this page; the actual engagement is as described here.
Banking & data partners
Regulated parties we retrieve data from. They act under their own regulatory obligations and the end user's consent — Lexabit does not share customer data with them or instruct them to process data on Lexabit's behalf, so they are not sub-processors in the Article 28 sense. For safety, the full roster named in our agreements is listed here with each provider's honest current status (mirroring Banking & Data Providers).
| Provider | Purpose | Basis | Region | Status |
|---|---|---|---|---|
 Enable Banking Oy | Open-banking (PSD2) account and transaction retrieval | Authorized TPP, supervised by its national FSA; access authorized by the end user at their bank | EEA | Active |
 Neonomics AS | Open-banking (PSD2) account and transaction retrieval | Authorized TPP; no data flows today | EEA | Integration built — not active |
 Tink AB | Open-banking (PSD2) — named in the Master Agreement ahead of use | Authorized TPP; not integrated, no data flows | EEA | Not yet integrated |
 Aiia A/S (a Mastercard company) | Open-banking (PSD2) — named in the Master Agreement ahead of use | Authorized TPP; not integrated, no data flows | EEA | Not yet integrated |
Enable Banking also appears in the Data Processing Agreement's approved sub-processor list — included there for completeness; the engagement model is as described here and on Banking & Data Providers, and Lexabit does not instruct it to process customer data on our behalf.
Public national business registries feed the self-hosted Data Registry; how each source is engaged is described on Banking & Data Providers.
MongoDB is self-hosted on Lexabit's own DigitalOcean infrastructure and is not a third-party sub-processor.
Changes to this list are announced to customers in advance. A downloadable export lives on the Downloads page. Questions: security@lexabit.com.