Sub-processor list
Every third party LandedFees uses to deliver the service, what they process, and their region.
Sub-processor list
LandedFees uses a small set of vetted sub-processors to deliver the product. The list below is the canonical statement of who touches customer data. The trust page is the always-current version.
Infrastructure
Supabase: managed Postgres, object storage, and auth. Region eu-central-1 (Frankfurt).
Vercel: application hosting, edge functions. Global CDN with EU-region compute for the primary functions.
Cloudflare: WAF, DDoS protection, DNS. Global network.
Sentry: error tracking. EU region enabled.
Payments
Dodo Payments: merchant of record, hosted checkout, subscription billing, and international VAT and GST handling.
Resend: transactional email (verification, invitation, receipts, alerts). No marketing email is sent through this pipeline without explicit opt-in.
AI providers
Anthropic (Claude): semantic HS lookup, finding narrative drafting on PSC memos, and the classification aid on the calculator. Data is not used for training under the Anthropic API terms.
Data providers
CBP CROSS: public rulings corpus (no PII exchanged; read-only).
WCO, TARIC, US ITC, HMRC, CBSA, SAT: public tariff schedules (read-only, no PII exchanged).
DataForSEO: used only for the marketing SEO tooling, not for customer data.
Changing the list
Adding a sub-processor triggers a notification to customers on Business tier and Enterprise via email, per the DPA. The updated list appears here and on /trust simultaneously.
Frequently asked questions
Is customer data ever sent to an AI provider
Yes for specific paths: the semantic HS classifier sees the product description (not the full invoice) and the finding narrative drafter sees the finding metadata (never the full 7501). No API keys or authentication data ever leave the LandedFees perimeter.
Do you have a signed DPA with every sub-processor
Yes. DPAs with each are on file. Business tier customers can review under NDA.
Can I opt out of a specific sub-processor
Not on Pro or Growth. Enterprise customers can negotiate a substitution or a mirror deployment.
Which region does each sub-processor use for our data
Every processor listed above holds LandedFees customer data in EU regions unless explicitly noted otherwise. Cloudflare and Vercel are global for reads but hold state in EU regions.
Related
Compliance
Data handling: region, encryption, retention
Storage in EU (Frankfurt, eu-central-1). AES-256 at rest. TLS in transit. Uploaded invoices live in the same region as the app database.
Compliance
Export or delete your data
Export your workspace as JSON or CSV. Delete your account and let the durable GDPR erasure job propagate the deletion to every sub-processor.
Still stuck
Paid tiers can open a ticket from the in-app support inbox. Free users can email operator support at info@growyourbrand.io.
Open a ticket