Sub-processors — Laruna
Version 1.0 · Effective: 16 July 2026
1 · What a sub-processor is
A sub-processor is a provider we engage that processes your customers' personal information on your behalf, to deliver the service. Each one receives only what its function requires, is bound by data-protection terms no less protective than our DPA, and we remain liable for its performance.
Providers that never receive client personal information are not sub-processors and are not listed here — for example our source-code hosting (code only, no client data) and our internal ops alerting (alert titles only). Those are covered by our internal vendor register.
2 · Current sub-processors
| Provider | Purpose | Location | Data shared |
|---|---|---|---|
| DigitalOcean | Hosting — the servers and databases the platform runs on | Australia (Sydney) | All platform data you store, encrypted at rest |
| Anthropic | AI processing — drafting, sorting and analysis | United States | Only the text needed for a task, at run time. Never used to train models |
| Resend | Transactional email — approvals, notifications, invoices | United States / EU | Recipient address and message content, at send time |
| Stripe (when payments are enabled) | Payments | United States / Australia | Customer name, email and amounts. Card details go directly to Stripe and never touch our servers |
| Namecheap | Domain and DNS services | United States | None — DNS records only; no personal information |
Some providers process data outside Australia (currently the United States). Where that happens we take reasonable steps consistent with APP 8 (cross-border disclosure) and impose contractual data-protection terms.
3 · Changes to this list
- We give 30 days' notice before adding or replacing a sub-processor that handles your data, by updating this page (and, where you've subscribed, by email).
- Each change is published here with a new version and effective date, so you can see exactly what changed and when.
- You may object on reasonable data-protection grounds; if we can't resolve it, you may terminate the affected service (DPA §5).
4 · Questions
Contact privacy@laruna.ai. The current list, our security overview and our policy set are available to clients on request (DPA §8).