Sub-processor register

1. What this is

A sub-processor is a third party that may process your data on our behalf. This page lists every one of them. It also shows the part that matters most to a procurement or risk team: which of them are reachable at all in each deployment shape.

Where a row says Not yet confirmed, we have not yet confirmed the underlying agreement. Those are facts about contracts, not about our software, so no test of ours can check them. We leave them visibly open rather than filling them with a plausible answer.

2. Where your data actually lives

One country: France, in the European Union. The application at app.lexcore.ng, including the database, the object store and every document you upload, runs on a virtual private server operated for us by Hostinger in France. The public marketing site at lexcore.ng is hosted by the same provider on a separate machine.

The marketing host sees who visited a marketing page. It never receives a matter, a document, or a user account. When you ask where your data rests, the answer is France. While a review runs, the text of the document under review is also sent to the AI provider your organisation selected (section 4), which is a second transfer and is stated as one in section 5.

No Nigerian law requires data localisation for this category of data. The Nigeria Data Protection Act 2023 permits a cross-border transfer where the recipient is subject to a law or binding instrument affording adequate protection; the terms under which we process your data, including the no-training term, are in the Data Processing Addendum.

3. Reachability by deployment shape

"Reachable" means our software can connect to it in that configuration, not that it is used on every request.

In sovereign mode a cloud AI provider is never constructed at all. There is no credential to leak and no setting to get wrong. That is a structural guarantee, not a configuration choice.

4. AI model providers

Each of these receives prompt text and document excerpts, which for LexCore means contract content. They are reachable on the managed quality tier and in customer-owned cloud accounts. None is reachable in sovereign, dedicated or air-gapped mode.

Ollama, vLLM and DiffusionGemma run inside the deployment. No data leaves, so they are not sub-processors.

5. Infrastructure we operate

Applies to the managed deployment. On a dedicated deployment you operate all of this.

PostgreSQL, Redis and the object store run on that same server, which we operate. They are not separate third parties.

Two transfers, not one: your data rests in the European Union, and the text of a document under review is sent to the AI provider named in section 2 while that review runs. Both are covered by contract, and both are recorded here so that this register is complete.

6. Payments

No card number or security code ever reaches LexCore. We receive billing metadata, and every provider webhook is signature-verified.

If the account owner ticks “Save this card” when paying with Paystack, we also keep Paystack's reusable payment token, encrypted, with the card's brand, last four digits and expiry month, so that a plan can renew or credits can top up. Removing the card in Settings deletes these and tells Paystack to stop honouring the token.

Dedicated deployments are licensed offline, so no payment processor is reachable from a dedicated or air-gapped installation at all.

7. Transactional email

Invitations, sign-in links, alerts and reminders. One provider is active at a time, and the current provider is Postmark. Adapters for Resend and SendGrid exist in the software but are not in use.

Email subject lines and invitations can carry matter and party names, so this is a genuine processor rather than plumbing.

8. Optional connectors

None of these is reachable until you connect it. Each is authorised per organisation, and you can disconnect any of them.

Our search index (Typesense) and web search (SearxNG) are self-hosted inside the deployment. They are not third parties.

9. Google API Services: Limited Use

LexCore's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

In practice: we do not use Google Workspace data to train any AI model, we do not sell it, we do not transfer it to others except as needed to provide the feature you connected or where the law requires it, and no person reads it except with your explicit permission or for security and legal reasons.

10. Analytics and error tracking

Neither carries document text. Both can carry information identifying which organisation did something, so we treat them as processors rather than as plumbing.

On our managed deployment the analytics tool is self-hosted Umami inside the same private network, so no third party is engaged at all. PostHog Cloud and hosted Sentry are reachable only where an organisation explicitly points us at them.

11. Changes to this register

We update this page when a sub-processor is added or removed, and we notify customers where the contract requires it. Adding a new AI provider without listing it here fails our build. Completeness of the provider list is enforced by an automated test, not by a reviewer remembering.

Questions about this register: dpo@lexcore.ng