Sub-processors
Last updated: July 26, 2026
Sleet Labs LLC operates SEC/OUTBOUND and uses the third-party providers below to deliver the Service. Each provider that processes live client or prospect data is covered by a data processing agreement or equivalent contractual protection, except as noted in a specific row. A provider listed ahead of a feature going live is marked below as pending its data processing agreement and processes no real client or prospect data until that agreement is executed. We keep this list current and give clients at least 30 days' notice before a new sub-processor begins processing client data (see our Privacy Policy §6).
Clients who want sub-processor change notices can email privacy@secoutbound.com with the subject line "Sub-processor notices."
| Provider | Role in the Service | Personal data processed | Primary location |
|---|---|---|---|
| Vercel, Inc. | Website hosting, contact-form endpoint, AI Gateway | Server logs, contact-form submissions, AI inputs/outputs | USA |
| Cloudflare, Inc. | DNS, registrar, network security | IP addresses, request metadata | USA |
| Plus Five Five, Inc. (d/b/a Resend) | Transactional email delivery — contact-form notifications | Contact-form data (name, email, message) | USA |
| Supabase, Inc. | System-of-record database + per-client dashboard (row-level security) | Prospect contact and profile data (name, work email, job title, company, company domain, country, LinkedIn URL, headline, location), lead score and verification status, the AI-personalized email opener, and per-prospect engagement events — isolated per client with row-level security | USA |
| Google LLC | Google Workspace — sending mailboxes, calendar; FormDFlow appointment scheduling on the operator's own Google Workspace calendar | Email content, contact metadata; FormDFlow prospect appointment bookings (booker name, work email, requested meeting time and time zone, and any booking-form answers) | USA |
| ZenLeads Inc. (d/b/a Apollo.io) | B2B contact-data sourcing | Public business contact data we retrieve | USA |
| GBD Software as a Service Ltd. (d/b/a MillionVerifier) | Email-address verification | Email addresses (verification only) | EU (Hungary) |
| 521 Products Pty Ltd (d/b/a Smartlead) | Outbound email sending and engagement tracking. Formal data processing agreement in execution; operating under Smartlead's standard data-processing terms in the interim. | Prospect contact data, email content, engagement events | Australia |
| OpenRouter, Inc. | AI-assisted email personalization — primary model routing. OpenRouter's standard commercial terms apply and Zero Data Retention is enforced at the account level (prospect prompts are not retained or used to train models); a mutually-signed enterprise data processing agreement is not yet in place. | Prospect public-profile snippets (name, job title, company, industry, public description) sent to the model to draft the email opener | USA |
| OpenAI, L.L.C. | Underlying model provider for personalization (served via OpenRouter). OpenRouter's standard commercial terms apply and Zero Data Retention is enforced at the account level (prospect prompts are not retained or used to train models); a mutually-signed enterprise data processing agreement is not yet in place. | Same prospect public-profile snippets, processed by the routed model | USA |
| Anthropic PBC | AI-assisted email personalization — fallback model (direct API / Vercel AI Gateway) | Same prospect public-profile snippets, only when the primary route is unavailable | USA |
| Stripe, Inc. | Payment processing for clients | Client billing details (we never see full card numbers) | USA |
ZenLeads Inc. (d/b/a Apollo.io) and GBD Software as a Service Ltd. (d/b/a MillionVerifier) are listed for transparency as independent third-party data sources or verification providers from which we obtain or verify business contact data as an independent controller.
Scheduling. SEC/OUTBOUND does not operate a meeting scheduler of its own. When a prospect books a meeting, they do so on the client's own calendar and booking link (for FormDFlow, the operator's own Google Workspace appointment-scheduling calendar, processed by Google LLC as listed above); the client is the controller for that booking-and-calendar data. The previously evaluated self-hosted cal.diy scheduler is suspended and processes no client or prospect data.
Questions about this list: privacy@secoutbound.com.