Sub-processors
Last updated 10 August 2026
Liffey is a processor acting on its customers’ instructions. This page names every sub-processor, what each does, and where it processes data.
It is published rather than available on request, because a security review should be able to complete without an email. It mirrors Annex C of the data processing agreement.
1. Core sub-processors
These four are engaged for every workspace, on every plan. All four process within the European Union.
| Sub-processor | Purpose | Location | Certifications |
|---|---|---|---|
| Neon, Inc. | PostgreSQL database hosting for all structured data and knowledge base content | EU (Frankfurt, Germany) | SOC 2 Type II, ISO 27001:2022 |
| Vercel, Inc. | Application hosting and serverless compute | EU (Frankfurt, Germany) | SOC 2 Type II, ISO 27001:2022 |
| Amazon Web Services (Amazon Bedrock) | AI inference and embedding generation, serving Anthropic and Amazon models | EU (Frankfurt, Germany) | SOC 2 Type II, ISO 27001:2022, Bedrock in scope |
| Resend, Inc. | Transactional email: sign-in codes, invitations, notifications | EU (Ireland) | SOC 2 Type II |
The database, application compute, AI inference, embedding generation and transactional email therefore all take place inside the EU.
2. Optional source connectors
These are engaged only where you choose to connect them. Liffey reads the content you authorise and stores the derived text within the EU. Several of these services are operated outside the EU, or in a region set by your own account, and connecting one is your documented instruction to read from it.
| Connector | Purpose | Location |
|---|---|---|
| Google (Drive, Gmail, Analytics, Search Console) | Reading content and metrics you authorise | US or EU, per your own account |
| Microsoft (OneDrive, SharePoint) | Reading content you authorise | US or EU, per your own account |
| Slack | Reading channels you authorise | US or EU, per your own account |
| HubSpot or Zoho | Reading CRM records you authorise | Per your own CRM account region |
| Otter.ai | Reading meeting transcripts you authorise | US |
| GitHub | Reading repositories you authorise | US |
| Reading your own advertising performance data | US or EU, per LinkedIn | |
| Canva | Exporting designs you authorise | Per your own account |
You choose which of these to connect, and you can disconnect any of them at any time. Browsing and rescoping stay with the member who connected the source.
3. Which AI models are used
AI inference runs on Anthropic’s Claude models and Amazon models, accessed through AWS Bedrock in Frankfurt. Anthropic holds ISO/IEC 42001:2023 for AI management systems.
Under the enterprise terms Liffey holds with those providers, your inputs are excluded from model training, and prompts and responses are processed in memory rather than retained at the AI layer.
Where you supply your own model provider, that provider is engaged on your instruction and recorded against your workspace.
4. Transfers outside the EEA
Liffey does not transfer your personal data outside the European Economic Area except in two cases, both set out in the data processing agreement: where you connect an optional source located in a third country, in which case Liffey reads the authorised content and stores the derived text within the EU; and where you give prior documented instruction. In each case a valid Chapter V transfer mechanism applies.
5. How changes are notified
Liffey gives at least 30 days’ prior notice by email to workspace owners before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. Where an objection cannot be resolved in good faith, you may terminate the affected part of the service and receive a pro-rata refund of prepaid fees.
To receive change notifications at a different address, write to hello@liffey.ai.
6. Certificates and reports
Provider audit reports and certificates are available on request, subject to each provider’s non-disclosure terms. Liffey’s own architecture is documented control by control at liffey.ai/security and at the trust centre.