Subprocessors

1. Purpose of This Page

This page identifies the third-party companies ("subprocessors") that Libertas Link engages to help deliver the Libertas Linkservice (the "Service"). It is intended to provide transparency to our customers about who may process personal data on our behalf and where that processing takes place.

This page supplements, and is incorporated by reference into, our Data Processing Addendum ("DPA") and our Privacy Policy. Where the DPA and this page address the same subject matter, the DPA controls. Capitalized terms used but not defined here have the meaning given in the DPA. This page is effective as of, and was last updated on, the date shown above.

2. What a Subprocessor Is and How Libertas Link Uses Them

A "subprocessor" is a third party that Libertas Link authorizes to process customer personal data in order to provide part of the Service on our behalf, under our instructions. Libertas Linkis an AI assistant that works over a business's own uploaded documents: customers upload documents, ask questions, and receive cited answers, and may use the Service to draft replies. To make this possible, we rely on a small number of carefully selected subprocessors for infrastructure, storage, AI inference, payment processing, and authentication.

We require each subprocessor to be bound by written terms that impose data-protection obligations no less protective than those in our agreement with you, and that limit the subprocessor to processing data only as needed to provide its service. We do not use customer content to train any general-purpose or foundation AI models, and we contractually require our AI inference provider not to do so either. Libertas Link is intended for general business records only; protected health information (PHI) and other specially regulated records are contractually prohibited, and the Service is not offered as a HIPAA-covered or business-associate arrangement.

3. Current Subprocessors

The following table lists the subprocessors Libertas Link currently engages to provide the Service:

The sections below describe how each subprocessor is used in more detail.

4. Infrastructure, Storage, and AI Inference (Cloudflare)

Libertas Linkis built and hosted on Cloudflare's developer platform, configured to process and store data in the United States. We use the following Cloudflare services:

• Workers: serverless compute that runs the application logic of the Service.
• D1: the relational database that stores account, workspace, and document metadata.
• R2: object storage that holds the documents you upload to your workspace.
• Vectorize: the vector database that stores embeddings of your content to power search and retrieval.
• Workers AI: the AI inference platform that generates embeddings and the cited answers and drafts you request.

Cloudflare processes this data solely to provide hosting, storage, search, and inference to us, and is contractually prohibited from using your content to train its own or any third party's general-purpose AI models.

5. Payments (Stripe)

We use Stripe to manage subscription billing and to process payments. When you subscribe to a paid plan, Stripe collects and processes your billing contact details and payment information and returns subscription and transaction metadata to us. Payment card data is handled directly by Stripe under its PCI-DSS compliant environment; we do not store full payment card numbers. Stripe processes this data to provide payment services and in accordance with its own role as a processor and, where applicable, as an independent controller for fraud-prevention and regulatory purposes.

6. Authentication (Better Auth)

We use Better Auth to manage account creation, sign-in, and session management. It processes account identifiers (such as your email address), authentication credentials, and session data so that we can verify your identity and keep your account secure. Authentication data is processed and stored within our United States environment.

7. Data Residency

The Libertas Link Service is designed for United States data residency. Customer account data, uploaded documents, derived embeddings, queries, AI-generated responses, and authentication data are processed and stored within the United States. Our subprocessors are engaged in a manner consistent with this US-only posture for the Service. If we introduce processing in another region in the future, we will update this page and follow the change-notification process described below.

8. Notice of Changes

We may add or replace subprocessors as the Service evolves. When we make a material change to this list, we will update this page and revise the "Last updated" date above. Customers who wish to receive advance notice of new subprocessors may subscribe to updates by emailing support@libertaslink.com with the subject line "Subprocessor Updates," and we will notify subscribed customers in accordance with the notice period set out in the DPA.

9. Customer Objection Rights

If you object on reasonable, data-protection grounds to our use of a new subprocessor, you may notify us within the objection window specified in the DPA. We will work with you in good faith to address your concern. If we are unable to do so, the rights and remedies available to you (including, where applicable, termination) are governed by the DPA. Please refer to the DPA for the controlling terms regarding subprocessor notification and objection.

10. Contact

For questions about this page or any of our subprocessors, please contact us at: