← Back to LaimonTree

Subprocessors

Last updated: 27 October 2026 · Draft, pending review by counsel

These are the companies that process personal data on behalf of LaimonTree customers when you use LaimonTree. The list is generated from the product's own configuration, and a test fails when the product starts using a provider that is not on it. We tell customers at least 30 days before a subprocessor is added or replaced (customer terms, section 7). Questions: [email protected].

Overview

• Mistral AI: Analysis of interview transcripts: diagnostics, criteria, scenarios, unit assignments, value streams, pulse rounds, learning-appetite tagging and interview coverage checks
• xAI: Voice interviews: live speech-to-text of the interviewee, the AI interviewer's reasoning and spoken reply (text-to-speech) over one realtime session
• Resend: Interview invitations, reminders, follow-up questions and transcript-review links
• MongoDB Atlas: Primary database for all application data, background-job queue and agent conversation checkpoints
• Fly.io: Runs the LaimonTree API, WebSocket service and background jobs
• Cloudflare: Serves the customer web app, the operator console and the public website
• Clerk: Authenticates customer users and verifies session tokens; separate Clerk instance for the operator console
• Stripe: Charges for projects and subscriptions, invoices, payment-method collection (Stripe Checkout and Stripe.js)
• Hetzner: Stores uploaded files: project documents, interview attachments, chat uploads and rendered voice samples
• Expo: Delivers push notifications to the LaimonTree mobile app

1. Mistral AI

Mistral AI SAS (La Plateforme API: chat completions, OCR)

Purpose

• Analysis of interview transcripts: diagnostics, criteria, scenarios, unit assignments, value streams, pulse rounds, learning-appetite tagging and interview coverage checks
• Reading uploaded documents (text digests and OCR) and the Laimon assistant in the app chat

Data

• Interview transcripts (interviewee answers, free text; names are not needed for the analysis but can appear in the text)
• Interview preparation tables and uploaded documents
• Organisation model data (teams, roles, units, workforce figures) in prompts
• Messages typed to the Laimon assistant

Location: EU (France), per customer terms v2; endpoint api.mistral.ai

2. xAI

xAI (Grok: realtime voice, speech-to-text, text-to-speech, chat)

Purpose

• Voice interviews: live speech-to-text of the interviewee, the AI interviewer's reasoning and spoken reply (text-to-speech) over one realtime session
• Written interviews: the AI interviewer's next question and opening message
• Voice samples for the avatar picker (fixed sample text, no personal data)

Data

• Interviewee voice audio, streamed from the interviewee's browser directly to xAI during a voice interview
• Interview transcript so far and the interviewer prompt (project and organisation names, interviewee first name, prepared questions)

Location: To be confirmed (xAI endpoint api.x.ai; hosting region not pinned in config, likely outside the EEA) (to be confirmed)

Speech-to-text is a cloud service, not self-hosted: the interview page opens a WebSocket from the browser to wss://api.x.ai/v1/realtime with a short-lived secret minted by our backend, and sends the microphone audio there. The transfer mechanism and the xAI data-retention terms are to be confirmed.

3. Resend

Resend (transactional email delivery)

Purpose

• Interview invitations, reminders, follow-up questions and transcript-review links
• Organisation invitations, trial and billing notices

Data

• Recipient name and email address
• Organisation and project names, interview link (contains the interview token)
• Follow-up question text sent by the consultant

Location: To be confirmed (Resend sending region is not pinned in config) (to be confirmed)

4. MongoDB Atlas

MongoDB, Inc. (MongoDB Atlas, managed database)

Purpose

• Primary database for all application data, background-job queue and agent conversation checkpoints

Data

• All customer content: interview transcripts, prep tables, projects, units, scenarios, members, audit logs
• Account data (name, email, role)

Location: EU, per customer terms v2 (cluster region itself is set in Atlas, not in this repo: to be confirmed) (to be confirmed)

5. Fly.io

Fly.io, Inc. (application hosting of the backend API)

Purpose

• Runs the LaimonTree API, WebSocket service and background jobs

Data

• All data in transit and in memory while processed
• Application log files on the machine (errors and request metadata; redacted of message bodies, tokens and transcripts)

Location: EU (Frankfurt, primary_region fra in fly.toml)

6. Cloudflare

Cloudflare, Inc. (Workers: delivery of the web app, admin console and website)

Purpose

• Serves the customer web app, the operator console and the public website

Data

• IP address and request metadata of visitors
• No application data: the app calls the API directly; Workers only serve static assets

Location: EU, per customer terms v2 (global edge network; to be confirmed for the website) (to be confirmed)

7. Clerk

Clerk, Inc. (sign-in and session management; separate instance for operators)

Purpose

• Authenticates customer users and verifies session tokens; separate Clerk instance for the operator console

Data

• Name, email address, authentication identifiers and session tokens of account holders and operators

Location: To be confirmed (Clerk instance region is set in the Clerk dashboard) (to be confirmed)

Interviewees do not sign in: they use a personal interview link and never reach Clerk.

8. Stripe

Stripe Payments Europe, Ltd. / Stripe, Inc. (payments and subscriptions)

Purpose

• Charges for projects and subscriptions, invoices, payment-method collection (Stripe Checkout and Stripe.js)

Data

• Billing contact name and email, organisation name, subscription and invoice data. Card numbers go to Stripe directly and are never stored by LaimonTree

Location: To be confirmed (Stripe processes in the EU and the US) (to be confirmed)

9. Hetzner

Hetzner Online GmbH (S3-compatible object storage)

Purpose

• Stores uploaded files: project documents, interview attachments, chat uploads and rendered voice samples

Data

• Files uploaded by consultants and interviewees (may contain personal data)

Location: Germany (region fsn1 in code, per customer terms v2; the storage URL can point at hel1, Finland: to be confirmed per bucket) (to be confirmed)

10. Expo

650 Industries, Inc. (Expo push notification service)

Purpose

• Delivers push notifications to the LaimonTree mobile app

Data

• Push token, device platform and name, notification title and text

Location: To be confirmed (Expo push service, not pinned in config) (to be confirmed)

Only used when a user has registered a mobile device.

Not subprocessors

• Error tracking and product analytics: None in code: no Sentry, PostHog, Google Analytics or similar SDK or script in the backend, app, console or website
• Claude / other MCP clients: Customer-initiated: a consultant connects their own AI client to the LaimonTree MCP server; the customer chooses and contracts that provider
• Google Fonts: Allowed by the API content-security policy but not loaded by the app or website