Sub-processors
LumoAuth uses the third-party sub-processors below to deliver and operate the platform. This page is the canonical, public list referenced in the LumoAuth Data Processing Agreement (DPA).
For change notifications, subscribe an address on the portal's Sub-processors page (/orgs/{orgId}/portal/gdpr/subprocessors); every change to the list is e-mailed to subscribers. The public list is at /legal/subprocessors on your deployment. We publish at least 30 days before adding or replacing a sub-processor that touches Customer Personal Data.
The live list is also served without sign-in at /legal/subprocessors, linked from the cookie banner.
Organization administrators can also see the current list and subscribe an email address to change announcements on the Sub-processors page of the portal (/orgs/{orgId}/portal/gdpr/subprocessors): enter the address under Subscriptions and click Subscribe.
Infrastructure & hosting
| Sub-processor | Function | Region(s) | Data processed |
|---|---|---|---|
| Hetzner Online GmbH | Primary cloud hosting (compute, storage, networking) | US, EU | All Customer Personal Data — encrypted at rest |
| Cloudflare, Inc. | DDoS protection, WAF, edge TLS termination, CDN for static assets | Global (no PII at rest) | IP, headers, request URLs (transient logs) |
Communication
| Sub-processor | Function | Region(s) | Data processed |
|---|---|---|---|
| Resend (Resend, Inc.) | Platform mailer for transactional email (verification, password reset, magic links, notifications), unless the organization routes mail through its own provider | US | Email addresses, message content |
| Google Firebase (Google LLC) | Mobile push notifications via FCM (only if push MFA (multi-factor authentication) is enabled) | US | Device push tokens |
AI providers (only when AI features are enabled by the customer)
| Sub-processor | Function | Region(s) | Data processed |
|---|---|---|---|
| Anthropic, PBC | Claude API for AI policy-parsing, AI theming | US | Prompts (no PII unless the operator includes it) |
| OpenAI, LLC | GPT API (alternative to Anthropic; customer-selectable) | US | Prompts |
| Mistral AI SAS | Mistral API (alternative; EU-domiciled option) | FR | Prompts |
| Google LLC (Vertex / Gemini) | Gemini API (alternative) | US, EU | Prompts |
The AI provider is a per-organization configuration. Customers who do not enable AI features have no data sent to any AI sub-processor.
Optional integrations (customer-controlled)
These are activated only when the customer explicitly configures them. None ship by default.
| Sub-processor | Function | Activation |
|---|---|---|
| Slack, Discord, Microsoft Teams | Webhook, alert and approval-channel delivery | Customer adds a webhook URL or channel |
| Email providers (Amazon SES, SendGrid, Mailgun, Resend, Postmark, SMTP) | Organization-routed transactional email | Customer configures an email provider under Integrations |
| SMS providers (Twilio, Vonage, AWS SNS, MessageBird) | Text-message one-time codes | Customer configures an SMS provider under Integrations |
| Log sinks (Splunk, AWS CloudWatch Logs, Microsoft Sentinel, Google SecOps, Elastic/OpenSearch, Sumo Logic, Amazon S3, OpenTelemetry, Datadog, Axiom, Honeycomb, Google BigQuery, Snowflake) | Audit-log forwarding | Customer configures a log sink under Integrations |
Self-attestations & certifications
Sub-processor compliance posture (most-recent attestations as of last update):
- Hetzner — ISO/IEC 27001 (DC Park Falkenstein, Helsinki, Ashburn)
- Cloudflare — ISO 27001, SOC 2 Type II, PCI DSS Level 1
- Resend — SOC 2 Type II
- Twilio — SOC 2 Type II, ISO 27001
- Anthropic / OpenAI / Mistral / Google — SOC 2 Type II (each)
Refreshed annually. Documents available under NDA on request: security@lumoauth.dev.
How we vet sub-processors
Before onboarding any sub-processor that processes Customer Personal Data:
- Security review — confirm SOC 2 Type II or equivalent.
- DPA in place — sub-processor signs LumoAuth's DPA, which carries the EU SCCs (Module 3) + UK Addendum + Swiss FADP terms.
- Data minimization — only the fields strictly required for the function get sent.
- Customer notification — 30-day notice on this page before activation.
Changes
| Date | Change |
|---|---|
| 2026-05-08 | Initial public sub-processor list. |
To object to a new sub-processor under your DPA: legal@lumoauth.dev within 14 days of notice.