Supabase
- Purpose
- Managed Postgres database, authentication, object storage
- Data categories
- All persisted Client and End-User data
- Region
- Singapore (primary)
- Contract type
- DPA + SCCs
[i]Subprocessor list
The processor chain.
Named, dated, contractable.
Laras uses these third-party services to deliver the platform. Each is bound by a Data Processing Agreement and contractually committed to data protection consistent with our DPA at /dpa.
To object to a Subprocessor on legitimate data protection grounds, email help@larasx.com. We will work with you on alternative arrangements where reasonably available.
Foundation-model, voice, and embedding providers are named individually below, with their processing region. Any provider not yet listed for a new feature will be added here with at least 30 days advance notice.
[ii]Active subprocessors
Every vendor with access to Client data, in one table.
Vercel
- Purpose
- Application hosting and content delivery network
- Data categories
- All runtime request and response data
- Region
- Singapore region (sin1)
- Contract type
- DPA + SCCs
Stripe
- Purpose
- Payment processing for engagement setup fees and monthly outcome invoices
- Data categories
- Billing metadata; no full PAN stored by Laras
- Region
- United States / European Union
- Contract type
- DPA + SCCs
Meta Platforms
- Purpose
- WhatsApp Business Platform API, Instagram Graph API, Facebook Page Messenger API, and Threads API for connected business channels
- Data categories
- Message content, contact identifiers, webhook payloads, IGSID, PSID, WABA phone numbers, Threads identifiers
- Region
- Global
- Contract type
- Meta Platform Terms + Data Use
Resend
- Purpose
- Transactional email delivery for account activation, magic links, operational notifications, and deliverability reporting
- Data categories
- Recipient email address, message subject and body, delivery telemetry
- Region
- United States
- Contract type
- DPA + SCCs via Resend
Qwen — Alibaba Cloud DashScope (foundation-model provider, APAC region)
- Purpose
- Customer-facing language generation and image understanding
- Data categories
- Prompts, message context, and user-uploaded images per request
- Region
- Singapore (international endpoint; compute may execute in Alibaba Cloud regions including mainland China)
- Contract type
- DPA; no-training enterprise terms
DeepSeek (foundation-model provider, analytical workloads)
- Purpose
- Reasoning, decision, planning workloads
- Data categories
- Prompt and context per request; no training opt-in
- Region
- Singapore / United States
- Contract type
- DPA; no-training enterprise terms
Kimi — Moonshot AI (foundation-model provider, creative tasks)
- Purpose
- Routed inference fallback and selected creative-generation tasks
- Data categories
- Prompt and context per request
- Region
- China
- Contract type
- DPA; provider-level pass-through
Anthropic (legacy foundation-model provider, pending migration)
- Purpose
- A small set of legacy features still being migrated off
- Data categories
- Prompt and message context only for the affected features; no training opt-in
- Region
- United States
- Contract type
- DPA + SCCs; zero-retention enterprise terms
Voyage AI (embedding provider)
- Purpose
- Text embeddings for retrieval and brand-context indexing
- Data categories
- Text fragments converted to vector representations
- Region
- United States
- Contract type
- DPA
Fish Audio (voice synthesis provider, TTS)
- Purpose
- Text-to-speech for the Laras Voice product
- Data categories
- Synthesized text, voice configuration; not used to clone end-user voices
- Region
- United States / Singapore
- Contract type
- DPA
Soniox (speech recognition provider, STT)
- Purpose
- Speech-to-text transcription for the Laras Voice product
- Data categories
- Audio segments and derived transcripts for the duration of a call
- Region
- United States
- Contract type
- DPA
Web search provider
- Purpose
- Web search and crawling for research-grounded responses
- Data categories
- Search queries derived from Client objectives; public-web responses
- Region
- United States
- Contract type
- DPA
Cloudflare R2
- Purpose
- Object storage for generated assets and uploaded media
- Data categories
- Uploaded files, generated images, attachments
- Region
- Global (Cloudflare edge network)
- Contract type
- DPA + SCCs via Cloudflare
Qdrant (self-hosted)
- Purpose
- Vector database for per-tenant retrieval embeddings
- Data categories
- Embedding vectors and minimal metadata (no raw end-user content)
- Region
- Singapore (self-hosted on Laras infrastructure)
- Contract type
- Operated by Laras under our own controls
[iii]Change log
Changes are dated, listed, and notified in advance.
We notify Clients of new Subprocessors via email at least 30 days before activation. Material changes from the past 12 months are listed below.
Recent changes
June 14, 2026
Added Resend (transactional email), a voice synthesis provider (TTS), and a speech recognition provider (STT). Expanded the Meta Platforms entry to enumerate WhatsApp Business Platform API, Instagram Graph API, Facebook Page Messenger API, and Threads API. Disclosed in connection with the Meta App Review submission. Named the specific foundation-model, voice, and embedding providers (DeepSeek, Qwen via Alibaba Cloud DashScope, Kimi by Moonshot AI, Voyage AI, Fish Audio, Soniox) and their processing regions.
Future additions or replacements will appear here with effective date and notification reference.
[iv]Object or inquire
Object to a Subprocessor on legitimate data protection grounds.
Email help@larasx.com. Reference the Subprocessor name, the workspace, and the specific data protection ground. We respond within 7 working days.