Sub-processors

1. How to read this list

When you use Lithora, you are the controller of the content in your workspace and we are your processor. A sub-processoris a company we engage to help us provide the Service, which necessarily handles some of that data. Everyone below is bound by a written data processing agreement, and transfers out of the EEA or UK rely on the European Commission’s Standard Contractual Clauses.

Each entry says where the service is configured to run. That is a statement of fact about our deployment, not a contractual residency guarantee — see section 7.

2. Core infrastructure

Engaged for every customer. Lithora cannot run without these.

• MongoDB Atlas

  United States

  MongoDB, Inc.

  Why we use it

  The primary database. Every workspace record Lithora holds is stored here — this is where your data lives.

  What it receives

  Accounts and profiles, teams and memberships, projects, work items, documents, notes, comments, messages, calendar events, file metadata, audit logs, and encrypted integration tokens.

• Amazon Web Services

  United States — us-east-1

  Amazon Web Services, Inc.

  Why we use it

  Application compute, Amazon S3 object storage, and CloudFront delivery of your files. Amazon Transcribe turns an audio or video file that is already in your workspace storage into text, and only when someone on your team asks for that specific file to be transcribed.

  What it receives

  Uploaded files and attachments, avatars, generated exports, server logs, and any voice note you record in chat. For a file you send to transcription, its audio as well — Amazon Transcribe returns the text, which is written back into the same bucket.

  There is no background or automatic transcription: a job starts only from an explicit request naming one file, and the request is refused unless that file sits under your own team or user prefix in our bucket, so it can never be pointed at anyone else’s material. The resulting transcript is then summarised by Amazon Bedrock — the row below. Lithora captures no audio by itself, but it is not true that the product cannot record: the chat voice note does, when you press record. That audio is stored here under its own prefix, which is outside the prefixes transcription will accept, so it is never sent to Amazon Transcribe.

• Amazon SES

  United States — us-east-1

  Amazon Web Services, Inc.

  Why we use it

  Transactional email — sign-in and verification codes, invitations, notifications, digests and billing email.

  What it receives

  Recipient name and email address, and the contents of the message being sent.

3. Feature-specific

Engaged only when you or a teammate uses the feature named.

• Amazon Bedrock

  United States — us-east-1

  Amazon Web Services, Inc.

  Why we use it

  AI inference on the Amazon Nova model family — the assistant, drafting, decomposition, summaries, PR review and semantic search.

  What it receives

  Only what a given request needs: your prompt, and the work items, documents and connected-tool context in scope for it.

  AWS states that Bedrock does not store inference inputs or outputs once the request is served, does not use them to train any model, and does not share them with the model provider. Lithora does not train models on your content either.

• Jitsi Meet (public instance)

  Global

  8x8, Inc. — meet.jit.si

  Why we use it

  Would host the video call behind a meeting link created from a Lithora calendar event. On lithora.app it does not: the deployment points at meet.team.lithora.io, a Jitsi server we run ourselves, and the browser loads the call from that host too.

  What it receives

  No call audio or video, on lithora.app. Where a deployment is pointed at the public instance instead, 8x8 would receive the generated room name and the live audio and video of whoever joins.

  Lithora does not record calls: nothing in the product starts, stores or exposes a recording of one, and where the server mints a join token it sets recording, livestreaming and transcription to false. The row is kept rather than deleted because the fallback is one unset environment variable away. Separately, if you record a call by your own means and put the file in your Lithora storage, you can ask us to transcribe it — that is the Amazon Transcribe path in the AWS row above, and it is the only way audio of a meeting reaches a sub-processor.

• Zoho Meeting

  India — zoho.in data centre

  Zoho Corporation

  Why we use it

  Schedules and hosts the call when someone books a product demo with us.

  What it receives

  The name, email address and requested time of the person booking the demo.

4. Business operations

• Dodo Payments

  Global

  Dodo Payments

  Why we use it

  Merchant of record for subscriptions — checkout, invoicing, monthly renewals, seat changes and tax.

  What it receives

  Billing name, email address, billing address and payment details.

  Card details are entered on Dodo’s own checkout and never reach Lithora’s servers. We store a subscription reference, its status and the seat count — never a card number.

5. Diagnostics and analytics

No workspace content — no work items, documents, notes or files — is sent to any of these. Identifiers that appear in a page address are: read the Google Analytics row, which is the one people assume is narrower than it is.

• Sentry

  European Union

  Functional Software, Inc.

  Why we use it

  Application error and crash reporting for the product app.

  What it receives

  Stack traces, the URL and method of the failing request, browser and operating-system details, and the affected account id.

• PostHog

  United States — US Cloud

  PostHog, Inc.

  Why we use it

  Product analytics inside the signed-in app — which features are used, and where people get stuck.

  What it receives

  Page views, feature events and Core Web Vitals, associated with your user id, email address, role, plan, team id and signup date.

• Google Analytics

  United States / Global

  Google LLC

  Why we use it

  Aggregate usage measurement. The same measurement id is loaded in two places: the lithora.app marketing site, and the signed-in product app on every page whose path does not begin with /admin.

  What it receives

  The address of the page it loads on, the referrer, an analytics cookie identifier, and an approximate location derived from IP address. In the product app those addresses carry workspace identifiers — the ids of a project, work item, document, team or whiteboard, and the token in an invitation or share link. We pass Google no account id, no email address and no workspace content.

  The two mounts do not behave alike, and the difference matters to you. On this marketing site the tag is not downloaded until you accept analytics cookies — decline and no request is made to Google and no analytics cookie is set. Inside the product app there is no consent gate at all: the tag loads for every signed-in user on every route outside /admin. We would rather state that here than let you find it in a cookie scan.

6. What is honestly not on this list

Integrations you connect yourself. Lithora talks to GitHub, GitLab, Bitbucket, Jira, Linear, Slack, Discord, Notion, Figma, Google Drive, Microsoft Teams, Vercel, Cloudflareand other platforms only because you authorised the connection, and only within the scopes you granted. We do not engage them on your behalf, so they are not sub-processors — they are independent controllers under their own terms. Revoking a connection from Settings → Integrations stops future sync, but does not delete data already exchanged with that provider.

Components we run ourselves. These look like third parties in an architecture diagram and are not:

• Meeting server — meet.team.lithora.io — the Jitsi instance our production deployment uses.
• Automation runner — n8n.lithora.io — executes the automations you build, on our own servers.
• Cache and rate limiting — Redis, running alongside the API rather than as a hosted service.

Enterprise SSO.Where a workspace signs in through its own identity provider, that provider is the customer’s, not ours. Lithora receives the assertion; it does not add a processor of our choosing.

7. Certifications and residency

We would rather you learn this here than in a questionnaire response:

• Lithora is in public beta.
• We do not hold a SOC 2 report, an ISO 27001 certificate, or any other independent security certification. Nothing on this site should be read as claiming one.
• We do not offer a data-residency guarantee. There is no EU-only or region-pinned deployment. The locations above describe where each service currently runs and can change; changes are announced under section 8.
• We are aligned with the GDPR and the CCPA/CPRA in how we handle data-subject rights, lawful basis and disclosure — alignment is not certification, and we do not present it as one.

What we do have is described on the Security page, and what we do with data is in the Privacy Policy.

8. Changes to this list

This page is the authoritative copy of the register and is re-reconciled with what the running system actually calls, not with what we intended it to call. When we add or replace a sub-processor we update this page and the review date at the top. To be emailed before a change takes effect, or to request our Data Processing Addendum, write to security@lithora.io and ask to be added to the sub-processor notification list.

9. Contact

Security and compliance questions, including objections to a sub-processor: