LumenNexus — Sub-processors

14 September 2026. Changes are notified to workspace owners at least 14 days before they take effect (DPA §6). Only what receives workspace or account data is listed; a service that sees nothing personal is not a sub-processor.

Sub-processor	Purpose	What it receives	Location	Their terms
Hetzner Online GmbH	Cloud server, block volume (the database), Storage Box (off-host backups and logs)	Everything the platform stores, at rest, on their infrastructure	Germany / Finland (EU)	hetzner.com/legal/privacy-policy · standard DPA (AVV) accepted in the Hetzner account panel · ISO/IEC 27001:2022
GitHub, Inc. (Microsoft)	Source code, CI, and the deploy runner that syncs files to the server	The application code and its tests; no workspace or account data (secrets never pass through CI). Listed for completeness	United States	github.com/site/privacy
Stripe, Inc. (only once billing is connected)	Subscriptions and payment	Workspace owner's email, customer and subscription ids, plan; card details are entered on Stripe's pages and never reach us	United States / EU entities	stripe.com/privacy
Hetzner Online GmbH — mail service (planned; only once mail is connected)	Sending sign-in codes and incident notices	Recipient email address, the six-digit code, the notice text (which names a finding and never its content)	Germany (EU)	hetzner.com/legal/privacy-policy
Fast-Back (only for a workspace that switches personalization on; off by default, never offered to a no-egress workspace)	Remembering how a member likes to be helped, so the assistant does not start cold	An opaque id for the member-in-this-workspace (no name, no address, no role); preferences the member states; and — only if the workspace also switches on conversation memory — the member's own questions, with addresses, telephone numbers, national and health identifiers, payment cards, dates of birth and the workspace's own product, column and people names removed first. Never the assistant's answers, never a document, passage or citation	Operator-controlled hardware, United States, reached over a private network	ADR 0036 · `docs/FASTBACK-ANSWERS.md`

Not sub-processors, and why:

The private inference gateway the assistant may use runs on infrastructure the operator owns and controls; it is part of the Processor, not a third party. A workspace that selects its own endpoint is choosing its own processor for that call, and a no-egress policy refuses any public one.
Henry, the monitoring agent, reads a read-only status summary (counts, durations, fixed phrases — never a tenant id, an email or a row) and runs on the operator's infrastructure.
OSV.dev receives the names and versions of our software dependencies for vulnerability matching — nothing about any tenant.

History

Date	Change
2026-09-14	First published list
2026-09-24	Fast-Back added, ahead of any workspace being switched on. Listed even though it is off everywhere today: a sub-processor disclosed after the first row is disclosed late.