Sub-processors
Last reviewed 6 August 2026
These are the services Luceria uses to run the platform, what each one touches, and where it runs. Customers on a data processing agreement are notified 30 days before a new sub-processor takes effect.
| Provider | Purpose | Personal data touched | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Account data, profiles, documents, applications, organisation records | EU |
| Vercel | Application hosting and compute | Request data in transit; server logs carry no document content | Functions in London; global CDN for static assets |
| Anthropic | AI processing (resume tailoring, interview prep, coach, verify summaries) | The text needed for the specific action, sent server-side per request | US (API over TLS) |
| OpenAI | AI processing for one lane: free-tier workflow generation | Workflow-generation inputs for free-tier users | US (API over TLS) |
| Resend | Transactional email | Email address, name, message content | US-based provider; sending infrastructure per account settings |
| Upstash | Rate limiting | Hashed IPs and counter keys only — never content | EU (London region) |
| Stripe | Consumer card billing only (organisations pay by invoice — no Stripe in that path) | Billing status; card details never touch Luceria (Stripe-hosted checkout) | Global (Stripe Payments Europe for UK/EU) |
| PostHog | Product analytics — loads only after explicit consent | Pseudonymous usage events with identifiers stripped from paths | EU cloud |
AI data, plainly
Your data does not train AI models. Both AI providers are used through their commercial APIs, which do not use submitted data for training by default, and Luceria has not opted into any training programme.
Only the text needed for the action you asked for is sent — server-side, never from your browser — and every AI call is metered and capped.
An organisation that sponsors your access can never see your documents, your applications or your AI activity. Organisation reporting is aggregate-only, and any figure covering fewer than five people is suppressed.
Registry sources that power company verification (Companies House, GLEIF, SEC EDGAR) receive no personal data — they are public-record lookups, not processors.
Questions: team@luceria.careers