Sub-processors
Every third party we bring in to help run Layven, what it does, and what data reaches it.
Last updated 4 August 2026
What this list covers
A sub-processor is any third party we use that ends up handling data on your behalf: hosting, payments, email, that kind of thing. This page is the complete, current list, and it is the one the Privacy Policypoints to as authoritative. We don't keep a second copy anywhere else.
One entry is not a sub-processor in the strict sense. When you use Sign in with Google, you authenticate with Google directly and Google decides for itself what to do with that, rather than acting on our instructions. We list it anyway, because what you want from this page is every party that receives data because of Layven, not a classification exercise.
The sub-processors we use
| Sub-processor | What it does | Data it touches | Location |
|---|---|---|---|
| OVH SAS (OVHcloud) | Application and database hosting | Account data, file metadata, activity log | Gravelines, France |
| OVHcloud Object Storage (OVH SAS) | Storage for all file content | File content, compressed and encrypted at rest with provider-managed keys | Gravelines, France |
| Vercel, Inc. | Hosting for the marketing site and web console | HTTP access logs including IP addresses; no file content | EU region; company US-headquartered |
| Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices | Name, email, billing and card details entered directly with Stripe; we store only a customer ID and subscription state | Ireland; onward transfer to Stripe, Inc. (US) under SCCs |
| PostHog, Inc. (EU Cloud) | Product analytics for the marketing site and web console | Pages visited, clicks and interactions, browser and device, IP address, and your user ID once you are signed in; no file content and no file metadata | Frankfurt, Germany |
| Resend, Inc. | Transactional email: verification, password reset, invitations | Recipient address and message content; no file content and no file metadata | United States, under SCCs |
| Google Ireland Limited | Sign in with Google, on the three sign-in pages only; optional, email and password works instead | Your name, email address, verified status and Google account ID reach us when you choose it; Google sees your IP address and that you signed in to Layven. No file content and no file metadata | Ireland for users in the EEA; onward transfer to Google LLC (US) under SCCs |
Your files and everything about them live on OVHcloud in France and go nowhere else. The other providers on this list handle the parts of the business that are not your data: hosting the site, taking payment, sending account email.
What we don't use
There is no Google Analytics, no advertising pixel, no ad network, no data broker, no CRM, no support widget, and no error-tracking service. We do not sell or share data with anyone for advertising, and nothing on this list is paid in data.
We do run product analytics, through PostHog on their EU Cloud in Frankfurt. It tells us which pages and features get used so we know what to build next. It is served through p.layven.io, our own domain, so it is not a third-party script in the usual sense, and it stays inside the EU. What it never sees is the thing that actually matters: your files, your file names, your folder structure, and your workspace activity log. Those live in France and are not sent anywhere.
There is exactly one genuine third-party script, and only on the three sign-in pages: Google's, so that the optional Sign in with Google button works. Loading it discloses your IP address to Google. It runs nowhere else on this site and nowhere in the console, it never sees your files or anything about them, and you can avoid it entirely by signing in with an email address and password.
There is also no third-party AI or embedding provider. Search runs on our own infrastructure, and customer content is never sent to a model API, not for search and not for anything else.
How we vet and change them
- We sign a Data Processing Agreement with Standard Contractual Clauses with any sub-processor that needs one.
- We email account owners before a new sub-processor starts processing customer data, not after.
- If you object to a new sub-processor, email info@layven.io.
Related
See the Privacy Policy for how this fits into the bigger picture, and the Terms of Service for the agreement this all sits under.