List of Subprocessors

Lemma, Inc. uses the following third-party subprocessors to assist in providing the Service. Each subprocessor has been vetted for compliance with applicable data protection regulations and is bound by contractual obligations that are no less protective than those described in our Data Processing Agreement. We will update this list whenever we engage a new subprocessor or change an existing one. If you have subscribed to subprocessor change notifications as part of your DPA, you will receive advance notice of any changes.

Neon, Inc. — PostgreSQL database hosting (United States, European Union). Provides managed PostgreSQL with connection pooling and branching for development workflows. Vercel, Inc. — Frontend hosting and serverless functions (Global CDN). Hosts the Lemma web application with edge-optimized delivery. Railway Corp. — Backend API hosting (United States). Hosts the Lemma API server, background workers, and WebSocket connections. Cloudflare, Inc. — CDN, DDoS protection, and R2 object storage (Global). Provides content delivery, security, and file storage for user uploads.

Google LLC (Firebase Authentication) — User authentication and identity management (United States). Provides email/password, social login, and multi-factor authentication. Resend, Inc. — Transactional email delivery (United States). Sends account verification, session reminders, and notification emails on behalf of Lemma. LiveKit, Inc. — Real-time video and audio infrastructure (United States, European Union). Powers live peer-to-peer skill sessions with video conferencing.

Sentry (Functional Software, Inc.) — Error tracking and performance monitoring (United States). Captures application errors and performance data to help us identify and resolve issues. PostHog, Inc. — Product analytics (European Union). Provides privacy-respecting analytics to help us understand how users interact with the Service. No advertising profiles are created. We do not share personal data with advertising networks or data brokers. All subprocessors are bound by data processing agreements that restrict them from using personal data for any purpose other than providing their services to Lemma.