laisy | Relationship intelligence for executive search

What is a sub-processor?

A sub-processor is a third party that processes personal data on our behalf when you use Laisy. We publish this list for transparency and to support our obligations under GDPR Article 28. Contact us for the provider and contractual information applicable to your pilot.

Cloud processing and retention

Laisy uses cloud services to process and store information. The services that receive content depend on the feature being used and its configuration. In production, audio uploaded in the web application is transcribed by AssemblyAI and recordings from the meeting notetaker are transcribed by Recall.ai. On the staging environment, audio uploaded in the web application is transcribed by OpenAI. The desktop staging workflow sends recorded call audio to Groq for transcription. Document files you upload, such as PDF and Word files, are sent to LlamaParse to extract their text. Provider retention, logging and training controls depend on the service and account configuration; we do not make a universal zero-retention promise. The provider and data scope for a pilot should be agreed before confidential information is uploaded.

Current sub-processors

This list reflects the services the current application code sends data to. A listed service receives data only when the related feature is enabled and configured for your environment. Optional integrations that are implemented but not enabled for a given pilot are not listed as active.

GroqLanguage-model inference, desktop audio transcription

Purpose: Primary language-model inference when configured for the selected feature. Groq also transcribes (Whisper speech-to-text) the calls you record with the Laisy desktop application. The desktop API is currently enabled on the staging environment only and is not part of the production web release.
Data categories: Prompts and generated responses. For desktop recordings: the audio of the recorded call, sent as chunks of about 60 seconds, and the resulting transcript.
Retention: Laisy's temporary cloud copy of desktop audio is deleted after successful transcription or scheduled to expire after 24 hours; that deletion is asynchronous. Provider-side retention is subject to the provider's terms and the configured account controls and is not changed by Laisy deleting its copy. No zero-retention guarantee is made on this page.
Contract: Provider terms apply. Contact us for the contractual information applicable to your pilot.

Amazon Web ServicesHosting, email delivery, fallback inference

Purpose: Amplify hosts the web application and EC2 hosts the API. SES delivers transactional email (verification, password reset, billing notices). Bedrock provides fallback language-model inference when configured.
Data categories: Application traffic; recipient email address and message body for transactional email; prompts and generated responses for fallback inference.
Retention: Subject to AWS service terms and the configured account controls.
Contract: AWS customer agreement and service terms. Contact us for the details applicable to your pilot.

OpenAIAudio transcription, staging environment only

Purpose: Audio transcription (Whisper) on the staging environment only. Audio uploaded in the staging web application, such as meeting recordings and voice notes, is transcribed by OpenAI's official API. Audio uploaded in the production web application is transcribed by AssemblyAI, not OpenAI, and desktop recordings are transcribed by Groq. OpenAI can also be enabled as a fallback for desktop transcription when Groq is unavailable; that fallback is not enabled.
Data categories: On staging: uploaded meeting and voice-note audio and the resulting transcripts. If the desktop fallback is enabled: desktop call audio chunks and the resulting transcripts.
Retention: Subject to OpenAI's terms and the configured account controls.
Contract: Provider terms apply. Contact us for the contractual information applicable to your pilot.

AssemblyAIAudio transcription, web application

Purpose: Transcribes audio uploaded in the production web application, such as meeting recordings and voice notes, and meeting recordings retrieved from connected Zoom or Microsoft Teams accounts when no transcript is available from those services.
Data categories: Meeting and voice-note audio, or a link to the recording, and the resulting transcripts.
Retention: Subject to the provider's terms and the configured account controls.
Contract: Provider terms apply. Contact us for the contractual information applicable to your pilot.

Recall.aiMeeting notetaker

Purpose: Runs the meeting notetaker, which is enabled in production. It is used only when you send the notetaker to a calendar meeting: a bot joins the call using its meeting link, records it, and Recall.ai transcribes the recording. Laisy then retrieves the transcript to structure the conversation.
Data categories: The meeting link, the notetaker's display name, the call's audio, video and participant names as captured in the recording, and the resulting transcript.
Retention: Subject to the provider's terms and the configured account controls.
Contract: Provider terms apply. Contact us for the contractual information applicable to your pilot.

CohereSearch result ranking when configured

Purpose: Reorders search results by relevance when you search or ask a question across your records.
Data categories: Your search query and the text excerpts of the matching results being ranked, which can include candidate profile details.
Retention: Subject to the provider's terms and the configured account controls.
Contract: Provider terms apply. Contact us for the contractual information applicable to your pilot.

LlamaIndex (LlamaParse)Document text extraction

Purpose: Extracts the text of documents you upload so Laisy can structure them. It is used for PDF, Word and similar files added to your workspace, files added to a mandate, CVs and other documents added to a candidate profile (including when you ask Laisy to re-extract a file), role briefs used to create or update a mandate, and PDF, Word, PowerPoint, Excel and other document files in a bulk import. It is enabled in production and staging.
Data categories: The complete uploaded file, such as a CV or role brief, which can include names, contact details, employment history and other personal data, and the extracted text.
Retention: Subject to the provider's terms and the configured account controls.
Contract: Provider terms apply. Contact us for the contractual information applicable to your pilot.

MongoDB AtlasPrimary database and search indexes

Purpose: Stores accounts, content and application state, plus the vector indexes used for search.
Data categories: Account data, user content (meetings, notes, candidates), encrypted integration tokens and embeddings.
Retention: Retained while your account exists, as described in the Privacy Policy. Deleting your account removes your personal data and unpublished personal items; knowledge already published to your firm's shared workspace stays with the firm. Account deletion requires any active subscription to be cancelled first.
Contract: MongoDB Cloud terms apply. Contact us for the details applicable to your pilot.

Voyage AIManaged text embeddings when configured

Purpose: Generates text embeddings for configured search and clustering paths. Depending on configuration, embedding requests go to the Voyage API or to MongoDB's embedding API.
Data categories: Selected text submitted for embedding.
Retention: Subject to the provider's terms and the configured account controls.
Contract: Provider terms apply. Contact us for the details applicable to your pilot.

StripeBilling

Purpose: Payment processing and subscription billing.
Data categories: Billing email and payment method tokens handled by Stripe.
Retention: Per the Stripe Services Agreement.
Contract: Stripe Services Agreement.

SentryDiagnostics: web disabled, API conditional

Purpose: Error monitoring. Frontend diagnostics are disabled in the current web release. Backend diagnostics run only when the server is configured with a Sentry DSN.
Data categories: When enabled: stack traces and request metadata.
Retention: Per Sentry's retention policy when enabled.
Contract: Provider terms apply. Contact us for the details applicable to your pilot.

MixpanelProduct analytics, production web application

Purpose: Product analytics for feature usage. Your browser sends analytics events directly to Mixpanel from the production web application, including on public pages before you sign in. Session replay, heatmaps and autocapture are disabled. The API can also send usage events to Mixpanel, keyed by your Laisy user ID, but only when the server is configured with a Mixpanel token; it is not configured in production.
Data categories: When you sign in: a pseudonymous identifier (your Laisy user ID), your organisation ID and role, account status details when available (such as subscription status and sign-up date), and which integrations you have connected. Laisy does not send your email address or name to Mixpanel. Usage events: pages viewed (without query strings, and without share, invite or password-reset tokens), buttons clicked, features used, counts, durations and error codes, the length of a search but not its text, and onboarding answers (role, industry and goal). Browser details: browser, operating system and device type, time zone, language, screen size, the referring website (and the search engine, if you came from one), how you arrived (for example a share or invite link), a session identifier and a device identifier. Laisy tells Mixpanel not to use your IP address to work out your location; as with any web request, Mixpanel's servers still receive the IP address of the connection. Events are linked to your user ID, so they are pseudonymous, not anonymous. Earlier versions of the web application also sent your email address and first name; the web application removes them from your Mixpanel profile the next time you use it while signed in.
Retention: Per Mixpanel's retention policy.
Contract: Provider terms apply. Contact us for the details applicable to your pilot.

Encryption

In transit: The public web application and the desktop application connect to the Laisy API over HTTPS. We do not assert a particular TLS version or transport configuration for every service listed above.
Integration tokens: Connected-account tokens are encrypted before they are stored.
Desktop recordings: The local recovery buffer of the desktop application is encrypted on the device with a key held in the operating system credential store. This protects the buffered files on disk; it is not end-to-end encryption, and cloud processing receives the audio in a form the services can process.
Storage: Storage encryption and backups are managed by the hosting and database providers under their configurations. We do not claim a universal encryption standard for all stored data on this page.

Notification of changes

This page is where we record changes to the services that process your data. Before we add a new sub-processor or replace an existing one, we will update this page and, for customers on plans that require it, provide advance notice by email. You can subscribe to updates by emailing the address below.

Your data rights

You can delete your account from Settings → Account → Danger Zone once any active subscription has been cancelled, or by emailing the address below. Deleting your account removes your personal data and unpublished personal items; knowledge already published to your firm's shared workspace stays with the firm. For data export requests, email the address below. See our Privacy Policy for full details on how we handle your data.

Contact

Questions about our sub-processors, contracts, or data handling practices?

Email: contact@laisy.io