Subprocessors

Lokbox uses the third-party services below to deliver its product. Each is bound by a Data Processing Agreement (DPA) and processes personal data only as instructed by Lokbox. Material changes (new subprocessors, removed subprocessors) are announced via email and on this page at least 30 days before they take effect.

Last updated: 2026-10-13

Anthropic PBC

Purpose: Model provider for current Claude processing. For the current Claude processing path through Amazon Bedrock, AWS states that model providers do not have access to customer prompts or completions.
Location: USA (model weights); current Claude processing uses AWS Bedrock's EU geographic inference profile, with Frankfurt as the primary source Region and documented European destination Regions

Amazon Web Services EMEA SARL

Purpose: For current Claude processing, Lokbox uses AWS Bedrock's EU geographic inference profile with Frankfurt as the primary source Region. AWS may process requests in the European destination Regions documented for that profile. For the current Claude processing path through Amazon Bedrock, AWS states that model providers do not have access to customer prompts or completions. Any retention by AWS depends on the configured Bedrock data-retention mode and AWS's documented exceptions.
Location: Luxembourg (corp); AWS Bedrock EU geographic inference profile with Frankfurt as the primary source Region and documented European destination Regions

Stripe Payments Europe, Ltd.

Purpose: Payment processing. Card details are stored at Stripe, never on Lokbox infrastructure.
Location: Ireland (EU)

Supabase, Inc.

Purpose: Postgres database + authentication + object storage (recordings).
Location: Switzerland (data centre Zurich, CH)

Infomaniak Network SA

Purpose: Frontend hosting (Next.js runtime + Caddy reverse proxy) AND agent backend infrastructure (browser automation runtime). Both servers in Zurich, Switzerland. Migrated from Hetzner (Falkenstein, DE) on 2026-08-16; frontend previously migrated from Vercel on 2026-05-27.
Location: Switzerland (Zurich)

Google LLC (Workspace APIs)

Purpose: Workspace OAuth (Gmail and Calendar APIs) — user-initiated skill execution against the user's own Google account.
Location: USA (regional caches in EU)

Notion Labs, Inc.

Purpose: Notion API — user-initiated skill execution against the user's own Notion workspace.
Location: USA (US-headquartered; user-initiated OAuth against the user's own Notion workspace — no Lokbox-side personal data processed beyond OAuth tokens)

Google Cloud Vertex AI

Purpose: Resolver and answer synthesis with Gemini models. Gemini: optional, only when enabled; not active by default at present. Anthropic Claude via Vertex AI: announced, not yet active.
Location: EU Member States, excluding Switzerland (Gemini: europe-west4, Netherlands; Claude: EU multi-region, announced)

Plus Five Five, Inc. (Resend)

Purpose: Account, billing and workspace notifications (verification, password reset, invitations, document requests, digests).
Location: USA; sending via the EU region (Ireland) according to the account configuration, account and main processing in the USA

Sentry (Functional Software, Inc.)

Purpose: Application error monitoring and performance traces (server-side only). EU data residency; no client-side telemetry transmits PII.
Location: EU region (ingest.de.sentry.io — Sentry GmbH operations)

Subprocessors
Subprocessor	Purpose	Location
Anthropic PBC	Model provider for current Claude processing. For the current Claude processing path through Amazon Bedrock, AWS states that model providers do not have access to customer prompts or completions.	USA (model weights); current Claude processing uses AWS Bedrock's EU geographic inference profile, with Frankfurt as the primary source Region and documented European destination Regions
Amazon Web Services EMEA SARL	For current Claude processing, Lokbox uses AWS Bedrock's EU geographic inference profile with Frankfurt as the primary source Region. AWS may process requests in the European destination Regions documented for that profile. For the current Claude processing path through Amazon Bedrock, AWS states that model providers do not have access to customer prompts or completions. Any retention by AWS depends on the configured Bedrock data-retention mode and AWS's documented exceptions.	Luxembourg (corp); AWS Bedrock EU geographic inference profile with Frankfurt as the primary source Region and documented European destination Regions
Stripe Payments Europe, Ltd.	Payment processing. Card details are stored at Stripe, never on Lokbox infrastructure.	Ireland (EU)
Supabase, Inc.	Postgres database + authentication + object storage (recordings).	Switzerland (data centre Zurich, CH)
Infomaniak Network SA	Frontend hosting (Next.js runtime + Caddy reverse proxy) AND agent backend infrastructure (browser automation runtime). Both servers in Zurich, Switzerland. Migrated from Hetzner (Falkenstein, DE) on 2026-08-16; frontend previously migrated from Vercel on 2026-05-27.	Switzerland (Zurich)
Google LLC (Workspace APIs)	Workspace OAuth (Gmail and Calendar APIs) — user-initiated skill execution against the user's own Google account.	USA (regional caches in EU)
Notion Labs, Inc.	Notion API — user-initiated skill execution against the user's own Notion workspace.	USA (US-headquartered; user-initiated OAuth against the user's own Notion workspace — no Lokbox-side personal data processed beyond OAuth tokens)
Google Cloud Vertex AI	Resolver and answer synthesis with Gemini models. Gemini: optional, only when enabled; not active by default at present. Anthropic Claude via Vertex AI: announced, not yet active.	EU Member States, excluding Switzerland (Gemini: europe-west4, Netherlands; Claude: EU multi-region, announced)
Plus Five Five, Inc. (Resend)	Account, billing and workspace notifications (verification, password reset, invitations, document requests, digests).	USA; sending via the EU region (Ireland) according to the account configuration, account and main processing in the USA
Sentry (Functional Software, Inc.)	Application error monitoring and performance traces (server-side only). EU data residency; no client-side telemetry transmits PII.	EU region (ingest.de.sentry.io — Sentry GmbH operations)

Subscribe to changes: email privacy@lokbox.ch with subject "subprocessor updates".

info@lokbox.ch · +41 78 845 84 66

Chratzernstrasse 2b, 4803 Vordemwald (Canton of Aargau), Switzerland