Subprocessor List
LevelSixLabs uses a small number of trusted third-party services to operate the platform. This page lists all subprocessors that may process customer data on our behalf.
Overview
We carefully select subprocessors and enter into data processing agreements (DPAs) with each one. All subprocessors are contractually required to protect your data to at least the same standard as we do.
Infrastructure
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Vercel, Inc. | Hosting, CDN, edge functions, cookie-free page-view analytics | UK (London) compute / global edge | All request data passing through the platform; page-view counts (page, referrer, country, device type — no cookies, IP address not retained) |
| Supabase, Inc. | Database, authentication, file storage | UK (London) | All customer and application data |
| Cloudflare, Inc. | Turnstile bot protection on sign-up, sign-in and password reset | Global (nearest edge) | IP address and browser signals at the moment a form is submitted — no account data |
Payments
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscriptions, invoicing | US / EU | Billing contact name, email, organisation name, payment method |
Email delivery
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Resend, Inc. | Transactional email (invites, password reset) | US | Recipient email address, invite metadata |
Product analytics
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| PostHog, Inc. | Product usage analytics — which features are used, so the product is improved on evidence rather than guesswork | EU (Germany) | A user identifier and the name of the action taken (for example "booking created"). No names, no email addresses, no lab data, and no cookies are set on your device — events are sent from our servers, never from your browser. |
Error monitoring
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Error and crash reporting | EU (Germany) | Error details, the page or action that failed, browser and user identifier |
AI processing
| Provider | Purpose | Location | Data processed |
|---|---|---|---|
| Anthropic, PBC | AI label scanning (optional feature) | US | Images uploaded for label scanning only — not linked to user identity |
Services you switch on, and services that get no personal data
The table above lists the subprocessors that handle personal data as part of the service everybody gets. Three other third parties are worth naming even though they do not belong in it, because leaving them unmentioned invites the question anyway.
| Service | When it receives anything | What it receives |
|---|---|---|
| Slack, or Microsoft Teams | Only if somebody in your lab pastes an incoming-webhook URL into Settings → Integrations | The content of the notifications you chose to forward — which can include a person's name. You configure the destination, so where it goes is your lab's decision rather than ours |
| Microsoft Graph (shared mailbox and calendar) | Not currently in use. The code exists and the credentials are unset in every environment, so nothing is sent | Nothing today. This page will be updated before that changes |
| PubChem | When a chemical is looked up, imported or added, to fetch hazard data | A substance name or CAS number. No personal data, no account identifiers and nothing that says which lab asked — which is why it is not a subprocessor |
Changes to this list
We will update this page when subprocessors are added, changed, or removed. Account holders will be notified by email at least 14 days before any new subprocessor begins processing personal data.
LevelSixLabs Ltd
Registered in England and Wales (company number 17377648). Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
For any questions about this document, contact us at privacy@levelsixlabs.com