Subprocessors
Version 1
Effective Date: May 3, 2026
centerleap — Subprocessors
Effective date: May 3, 2026 Last updated: May 3, 2026
This page lists the third-party subprocessors we use when providing the centerleap Services. It is incorporated into our Data Processing Addendum (DPA) at centerleap.com/legal/dpa and our Privacy Policy at centerleap.com/legal/privacy.
We only engage subprocessors that process Personal Data or Customer Content on our behalf. We maintain contracts with each that require them to protect your data and use it only for the services they provide to us. The list is current as of the date above. We notify customers of material additions or replacements as described in the DPA.
Core infrastructure & security
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Cloudflare | CDN, DDoS protection, WAF, bot management, edge computing | United States | Network traffic, security logs, limited request metadata |
| Vultr / RamNode | Cloud hosting and compute (application servers, mail edge, RAG) | United States | Application data, databases, encrypted storage |
| Supabase | Authentication, database, realtime | United States | User accounts, auth tokens, application data |
Communications & voice
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Telnyx | VoIP, SMS / MMS, phone numbers | United States | Call metadata, SMS content, voice traffic |
| Deepgram | Speech-to-text transcription | United States | Audio from calls (when transcription is enabled) |
| LiveKit | Video meetings (self-hosted option available) | United States | Video / audio streams (when meetings are used) |
AI & intelligence
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Anthropic | Large-language-model inference (AI features) | United States | User-selected documents and queries for AI. No training on your data. |
| Google Gemini | Large-language-model inference (AI features) | United States | User-selected documents and queries for AI. No training on your data. |
| ElevenLabs | Voice synthesis / audio AI | United States | Limited audio and text for voice features |
| Brave Search | Search capabilities (e.g., CRM lead enrichment) | United States | Anonymized search queries |
Mapping & routing
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| HERE | Mapping, routing, ETAs | Luxembourg / United States | Location data for dispatch and route features |
| LocationIQ | Geocoding and reverse geocoding | Germany | Address and location data (primarily server-side) |
Error monitoring & development
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Sentry | Error monitoring and performance | United States | Error reports with PII redaction applied before transmission |
| GitHub | Source-code repository and CI / CD | United States | No customer Personal Data |
Platform & integrations
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Google / Apple / Meta | App Store distribution, push notifications, device integrations | United States | Limited device identifiers for push and app functionality |
Notes
- Data location. Most primary storage and processing occurs in the United States. Some subprocessors operate global infrastructure.
- No training on your data. AI subprocessors (Anthropic, Google Gemini, and others) are used in zero-retention or no-training modes for your content.
- End-to-end encryption. For centerleap mail (and certain chat content), we hold only ciphertext where you enable E2EE. Subprocessors process only metadata or encrypted blobs.
- Updates. We review this list regularly. Material changes will be reflected here and notified as required by our DPA.
- Full details. See our DPA for rights, audit provisions, and international-transfer mechanisms (including EU Standard Contractual Clauses and the UK International Data Transfer Addendum).
Questions
Email privacy@generalsoftwarecompany.com.