Sub-processors
Every vendor Layers uses to store or process partner or end-customer data.
This is the current list. Material sub-processor changes are
communicated through the Partner API changelog.
Advance-notice windows and objection rights are governed by your DPA —
not by this page.
| Vendor | Purpose | Data touched |
|---|
| Google Cloud Platform | Application hosting, workflow orchestration, object storage | All application traffic, generated media, event stream |
| Supabase | Primary Postgres + auth + column-level secret store | Partner state, customer event records (hashed PII), OAuth tokens |
| Upstash | Rate-limit + idempotency cache | API key ids, per-minute counters, idempotency body hashes |
| Cloudflare | Edge DNS + WAF in front of in.layers.com | Request metadata only; no bodies stored |
| Vendor | Purpose | Data touched |
|---|
| Google Vertex AI / Gemini | Content generation, ads agent, scoring | Campaign prompts, brand/profile text |
| OpenAI | Inference for select pipelines | Campaign prompts, brand/profile text (per-request only, no training opt-in) |
| Anthropic | Inference for select pipelines | Same as above; per-request only |
| E2B | Sandboxed agent execution (App Machina, ads agents, UGC agents) | Agent scratch space only; purged on sandbox close |
| Replicate | Model hosting for image/video inference | Generation inputs; per-request only |
| Vendor | Purpose | Data touched |
|---|
SIFT (api.meetsift.com) | Public social-post metadata retrieval | Public post IDs, public metrics — no private account data |
| Meta Graph API | Ad + pixel management (CAPI) | API consumer; no Meta storage on our side |
| TikTok Business API | Ad + pixel management (Events API) | API consumer |
| Apple Search Ads | Ad management + attribution | API consumer |
| GitHub | GitHub App (repo access for App Machina, code analysis) | Installation metadata; repo contents read at App Machina run time only |
| Stripe | Credit purchases + partner billing | Partner billing contact, invoice metadata |
| RevenueCat | Optional revenue sync (webhook relay + metrics) | Partner-configured RevenueCat project data |
| Vendor | Purpose | Data touched |
|---|
| Resend | Transactional email to partners / end-users on your behalf | Recipient email, message body |
| Sentry | Error monitoring | Stack traces, request metadata (no bodies) |
| PostHog | Product analytics (Layers-employee usage) | Layers-employee product usage; no partner-visible data |
| Loops | Lifecycle email for Layers account owners | Layers account-owner email only |
| Linear | Issue tracker — receives customer feedback submitted through the in-app feedback form | Feedback text + user id |
All primary processing happens in the US. Layers does not currently
offer EU or APAC regional hosting. For EU → US transfers, the DPA we
countersign includes Standard Contractual Clauses — contact
legal@layers.com.