Home / Legal / Subprocessors

Subprocessors

Last updated July 17, 2026

These terms govern the Limen Systems website and evaluation materials. For a paid engagement, the separately executed agreement controls. This is not legal advice.

This page explains what a subprocessor is and lists the third-party providers Limen Systems relies on to operate its public website and corporate functions. Because the Limen platform is designed to run inside each customer’s own perimeter, our reliance on external subprocessors for customer operational data is minimal by design. This page covers the informational website and our own operations; subprocessor terms for a paid deployment are governed by the Data Processing Addendum in the Definitive Agreement.

1. What a subprocessor is

A subprocessor is a third-party service provider that Limen engages to process personal or operational data on our behalf in the course of delivering a service. Common examples include cloud hosting providers, analytics tools, and email-delivery services. When a subprocessor processes personal data, it does so under a contract that requires it to protect that data and to act only on documented instructions.

We publish this page for transparency, so that visitors and prospective customers can understand who is in the data path for our website and corporate operations, and can assess our supply chain as part of their own due diligence.

2. How our architecture minimises subprocessors

Limen’s core design principle is that data should not travel further than it must. The platform is built to be deployed inside the customer’s own environment — in the customer’s VPC or fully air-gapped — with domain-adapted models running in-perimeter and personally identifiable information masked before it ever reaches a prompt.

As a result, for a customer deployment there is typically no external subprocessor in the path of customer operational data: the data, the models, and the compute stay inside the customer’s boundary. This is a deliberate contrast with multi-tenant SaaS, where operational data routinely flows through the vendor’s cloud and its chain of subprocessors. Learn more about our approach on the Security page and how it fits the ownership model on Ownership.

The subprocessors listed below therefore relate almost entirely to our public marketing website and corporate operations — not to the platform that runs your operations.

3. Current website and corporate subprocessors

The following third parties support the Limen Systems website and our corporate communications. Each processes only the limited data described and is engaged under appropriate contractual and data-protection terms.

Subprocessor	Purpose	Data processed	Location
Vercel Inc.	Website hosting, content delivery, and edge infrastructure for limen.io	Server logs and technical request metadata (e.g., IP address, user agent)	United States
Google LLC (Google Analytics)	Aggregate website traffic and usage analytics	Pseudonymous usage and device data via privacy-respecting analytics	United States
PostHog Inc.	Product and website analytics, event and funnel measurement	Pseudonymous product-usage events and session metadata	United States / European Union
Transactional email provider	Delivery of transactional and briefing-related email (e.g., confirmations, replies)	Name, work email address, and message content you provide	United States

We keep this list current as a matter of practice. The specific transactional email provider is engaged under a data-processing agreement; we will name it on request to hello@limensystems.com. For details of what we collect through the website and why, see our Privacy Policy.

4. Subprocessors for customer deployments

For a paid engagement, the applicable subprocessors (if any) are defined in the Data Processing Addendum that forms part of the Definitive Agreement, together with the notification and objection rights described there. Because deployments are designed to run within the customer’s perimeter, the default position is that no Limen subprocessor processes customer operational data outside the customer’s environment.

Where a customer chooses a deployment topology that involves a specific cloud region, managed service, or model-hosting arrangement, those providers are identified and agreed in the Definitive Agreement rather than on this page, and are subject to the customer’s own approval.

5. Due diligence and data-protection terms

Before engaging a subprocessor that may handle personal data, we assess its security and privacy practices to a standard appropriate to the data involved, and we enter into a written agreement imposing data-protection obligations no less protective than those we owe.

These obligations typically include processing only on documented instructions, maintaining appropriate technical and organizational security measures, imposing confidentiality on personnel, supporting data-subject requests, and assisting with breach notification. Our overall approach to data is described in our Privacy Policy.

6. Changes and notification

We may add, replace, or remove subprocessors as our website and operations evolve. When we do, we will update the table above and the “Last updated” date at the top of this page.

For customer deployments, advance-notice and objection rights for any change of subprocessor are governed by the Data Processing Addendum, not by this page. We encourage prospective customers to review this page as part of their vendor due diligence and to raise any questions before a briefing.

7. Contact

To ask about our subprocessors, to request the name of a specific provider, or to raise a data-protection question, contact hello@limensystems.com.

Questions about this document: hello@limensystems.com