# Sub-processors (/docs/trust/subprocessors)



This is the current list. Material sub-processor changes are
communicated through the [Partner API changelog](/docs/api/operational/changelog).
Advance-notice windows and objection rights are governed by your DPA —
not by this page.

## Infrastructure [#infrastructure]

| Vendor                | Purpose                                                     | Data touched                                                     |
| --------------------- | ----------------------------------------------------------- | ---------------------------------------------------------------- |
| Google Cloud Platform | Application hosting, workflow orchestration, object storage | All application traffic, generated media, event stream           |
| Supabase              | Primary Postgres + auth + column-level secret store         | Partner state, customer event records (hashed PII), OAuth tokens |
| Upstash               | Rate-limit + idempotency cache                              | API key ids, per-minute counters, idempotency body hashes        |
| Cloudflare            | Edge DNS + WAF in front of `in.layers.com`                  | Request metadata only; no bodies stored                          |

## AI / Compute [#ai--compute]

| Vendor                    | Purpose                                                         | Data touched                                                                |
| ------------------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Google Vertex AI / Gemini | Content generation, ads agent, scoring                          | Campaign prompts, brand/profile text                                        |
| OpenAI                    | Inference for select pipelines                                  | Campaign prompts, brand/profile text (per-request only, no training opt-in) |
| Anthropic                 | Inference for select pipelines                                  | Same as above; per-request only                                             |
| E2B                       | Sandboxed agent execution (App Machina, ads agents, UGC agents) | Agent scratch space only; purged on sandbox close                           |
| Replicate                 | Model hosting for image/video inference                         | Generation inputs; per-request only                                         |

## Data / Integrations [#data--integrations]

| Vendor                    | Purpose                                                 | Data touched                                                           |
| ------------------------- | ------------------------------------------------------- | ---------------------------------------------------------------------- |
| SIFT (`api.meetsift.com`) | Public social-post metadata retrieval                   | Public post IDs, public metrics — no private account data              |
| Meta Graph API            | Ad + pixel management (CAPI)                            | API consumer; no Meta storage on our side                              |
| TikTok Business API       | Ad + pixel management (Events API)                      | API consumer                                                           |
| Apple Search Ads          | Ad management + attribution                             | API consumer                                                           |
| GitHub                    | GitHub App (repo access for App Machina, code analysis) | Installation metadata; repo contents read at App Machina run time only |
| Stripe                    | Credit purchases + partner billing                      | Partner billing contact, invoice metadata                              |
| RevenueCat                | Optional revenue sync (webhook relay + metrics)         | Partner-configured RevenueCat project data                             |

## Support / Internal [#support--internal]

| Vendor  | Purpose                                                                               | Data touched                                           |
| ------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------ |
| Resend  | Transactional email to partners / end-users on your behalf                            | Recipient email, message body                          |
| Sentry  | Error monitoring                                                                      | Stack traces, request metadata (no bodies)             |
| PostHog | Product analytics (Layers-employee usage)                                             | Layers-employee product usage; no partner-visible data |
| Loops   | Lifecycle email for Layers account owners                                             | Layers account-owner email only                        |
| Linear  | Issue tracker — receives customer feedback submitted through the in-app feedback form | Feedback text + user id                                |

## EU partners [#eu-partners]

All primary processing happens in the US. Layers does not currently
offer EU or APAC regional hosting. For EU → US transfers, the DPA we
countersign includes Standard Contractual Clauses — contact
[legal@layers.com](mailto:legal@layers.com).