01
Current sub-processors
As of 2026-04-22, we engage the following sub-processors:
| Vendor | Purpose | Data categories | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. | Website hosting + CDN + edge runtime | Request metadata, cookies, form submissions in transit | USA (global edge) | Signed DPA + Standard Contractual Clauses (EU & UK) |
| HubSpot, Inc. | CRM, marketing email, Meetings scheduling | Contact details, submission bodies, meeting artifacts | USA / EU | Signed DPA + SCCs + Data Privacy Framework |
| Google LLC (Google Cloud + Gemini API) | AI model inference (voice transcription, generation) | Voice audio, transcription text, generated content inputs | USA / EU | Signed DPA + SCCs + Data Privacy Framework |
| Meta Platforms, Inc. | Advertising integration — activated by customer | Campaign metadata, Pixel events (consent-gated) | USA / EU | Signed DPA + SCCs + Data Privacy Framework |
| Anthropic, PBC | AI model inference (copilot features — when enabled) | Prompt text, model responses | USA | Signed DPA + SCCs |
| Intuition Machines, Inc. (hCaptcha) | Bot mitigation on public forms | IP address, user-agent, challenge solution tokens | USA | Signed DPA + SCCs |
| Cloudflare, Inc. | DDoS mitigation, DNS, WAF (when in front of the site/app) | Request metadata, IP address | USA (global edge) | Signed DPA + SCCs |
Additional vendors may be engaged for infrastructure (monitoring, logging, incident alerting) that do not process personal data. These are listed internally and available on request.
02
Change notification
We give Controllers at least 30 days’ advance notice before adding or materially changing a sub-processor. Enterprise customers receive notice by email at the contact on file and in-product when applicable.
Controllers may object on reasonable data-protection grounds. We will work in good faith to address objections; if an objection cannot be resolved, either party may terminate the affected portion of the Services without penalty, consistent with the DPA.
03
Subscribe to changes
To receive notifications of sub-processor changes, email legal@hiluca.net with the subject line subscribe sub-processors and the contact name you want on the list. You can unsubscribe at any time with the same inbox.
04
Infrastructure context
We operate in the United States by default. EU-resident deployments are available on enterprise plans. Data remains within the contracted region for primary processing; secondary processing (AI inference, email delivery, bot mitigation) happens in the vendor’s documented regions.
All sub-processor relationships are reviewed annually and before engagement. Background on our posture is at /security.