Subprocessors
To run the Lydo Service we use a small set of third-party providers ("subprocessors") that process customer data on our behalf. This page is the current, authoritative list. Our Privacy Policy describes the categories of data each subprocessor handles and the legal basis for using them.
We have written agreements with each subprocessor that bind them to confidentiality, security, and (for the AI vendors) a prohibition on training their public foundation models with your team's content.
Current subprocessors
| Vendor | Purpose | Data location |
|---|---|---|
| Google Cloud / Firebase | Database (Firestore), file storage (Cloud Storage), authentication, Cloud Functions, push delivery (FCM) | United States |
| LiveKit Cloud | Real-time voice and video media routing for calls, Stage rooms, and AI agent voice channels | United States |
| Deepgram | Speech-to-text transcription of voice and video calls | United States |
| OpenAI | Text generation, translation, summarization, action-item extraction for Joby and approved AI agents | United States |
| Stripe | Payment processing and subscription billing | United States |
| Sentry | Crash reporting and application error monitoring | United States |
| Apple Push Notification Service | Push notification delivery to iOS devices | United States |
| Google Firebase Cloud Messaging | Push notification delivery to Android devices | United States |
AI subprocessors and training
Three of the subprocessors above (OpenAI, Deepgram, LiveKit's agent integration where applicable) process customer content as inputs to AI features. Our agreements with these vendors prohibit them from using your content to train their public foundation models. Where the vendor offers a "no-retention" or "zero-day-retention" mode for our tier, we use it.
Lydo does not train its own foundation models on customer content. We may use aggregated, de-identified usage signals (response length distributions, helpfulness ratings) to improve our own product.
User-authorized integrations
Third-party integrations and Model Context Protocol (MCP) connections let Joby and approved connected AI agents connect to tools your team already uses, for example Notion, Linear, GitHub, Google Calendar, or a CRM. These are not Lydo subprocessors; they are third-party services you authorize directly. When you connect one, the data needed to fulfill your request is sent to that provider, and that provider's privacy policy applies. Disconnecting an integration stops further sharing but does not retrieve data already shared.
Space admins can review and disable any connected integration at any time from Space settings → Integrations.
Data residency
All subprocessors above operate primarily out of United States data centers. Regional data residency is not generally available today. Enterprise customers with regional hosting requirements can contact team@lydo.chat to scope feasibility and terms; no regional commitment applies unless it is written into an Order Form.
How we vet subprocessors
- Each subprocessor is bound by a written agreement that incorporates GDPR Article 28 obligations and applicable U.S. state privacy laws.
- We assess each vendor's security posture (SOC 2 reports, ISO 27001 certifications, or equivalent) before adding them.
- For AI vendors, we require contractual no-training and data-retention commitments above the vendor's default consumer terms.
- We re-review subprocessors annually, or sooner if a material change in their security or privacy posture comes to our attention.
Questions
Email team@lydo.chat with subject "Subprocessor question." Enterprise customers may request our most recent vendor due-diligence summary under NDA.