Who handles your data, and how we customise your supply chain.
Hyperscalers and multi-tenant SaaS platforms force you to accept dozens of fixed subprocessors. Because every Lithus client runs on dedicated European servers, we keep the supplier chain short, and we agree and customise the exact subprocessor list with you before we deploy.
Three distinct scopes, shaped around your compliance needs.
Security and procurement teams need a clear boundary between suppliers that host customer workloads, internal tools used to run our engineering team, and corporate tools used when you visit our website or sign a contract.
Client cluster subprocessors
Every client cluster is single-tenant. Together with your team, we choose the European data centre operator (Germany, the Netherlands, or France), where encrypted off-site backups are stored, and which operational integrations are enabled.
Internal operational tooling
We use tools like Tailscale (peer-to-peer WireGuard encrypted), 1Password (end-to-end encrypted), and Twilio/Telnyx (on-call paging) to coordinate our engineering team, while keeping client workloads isolated on their own dedicated servers.
Website & commercial relationship
This website serves static HTML and self-hosted fonts with zero third-party analytics or tracking cookies. Corporate processors are only involved when you book a call, sign a contract, or pay an invoice.
Complete subprocessor and supplier register.
To give your procurement and security teams a complete view of our supply chain in one place, the table below lists every supplier across our managed client clusters, internal engineering tooling, and corporate operations.
| Supplier | Scope | Role & data access | Location / HQ | Customisation & notes |
|---|---|---|---|---|
| 1. Client cluster subprocessors (agreed per cluster) | ||||
| Hetzner / Worldstream / OVHcloud | Client cluster | Dedicated bare-metal servers, private network, and ISO 27001-certified data centre facilities | 🇩🇪 Germany🇳🇱 Netherlands🇫🇷 France | You choose the EU jurisdiction and operator with us before deployment. |
| OVHcloud | Client cluster | Encrypted off-site backups | 🇫🇷 France | All backups are encrypted inside your cluster before upload. We can also route backups to another EU provider or to a storage account owned by your company. |
| Exoscale | Client cluster & ops plane | Lithus core operations plane: secrets management, code hosting, and alerting | 🇨🇭 Switzerland🇦🇹 A1 Digital | Hosted in Switzerland under European jurisdiction. Monitoring and log storage can also be kept entirely inside your own cluster. |
| Scaleway | Client cluster (optional) | EU-hosted AI service used to assist engineers with alert triage | 🇫🇷 France | Optional, and can be disabled for your cluster on request. |
| Slack / Microsoft Teams | Client cluster & support | Shared engineering channel and alert notifications with your team | 🇺🇸 United States🇪🇺 EU residency | We work inside whichever chat platform your engineers already use. |
| 2. Internal operational tooling | ||||
| Tailscale | Internal ops | Private network coordination for engineering access | 🇨🇦 Canada🇺🇸 United States | Coordinates encrypted peer-to-peer connections for our engineers. |
| Cloudflare | Internal ops | Domain registration and DNS for Lithus domains | 🇺🇸 United States | Used for Lithus corporate domains and DNS management. |
| Twilio & Telnyx | Internal ops | Voice and SMS paging to the on-call engineer | 🇺🇸 United States🇮🇪 Ireland (EU region) | Delivers wake-up calls and SMS notifications for our 24/7 on-call rotation. |
| Mailgun & Postmark | Internal ops | Transactional email delivery | 🇺🇸 United States🇪🇺 EU region | Sends system and account notifications for internal Lithus services. |
| 1Password | Internal ops | Team password and credential manager | 🇨🇦 Canada | End-to-end encrypted credential vault for our engineering team. |
| Google Cloud Platform | Internal ops | Internal software build infrastructure | 🇪🇺 EU region🇺🇸 United States | Used to build and test internal Lithus software and container images. |
| Docker Hub & GitHub | Internal ops | Open-source container registries and build tooling | 🇺🇸 United States | Used for upstream open-source software packages and build automation. |
| CrowdSec | Internal ops | Network threat intelligence and IP blocklists | 🇫🇷 France | Provides community IP reputation blocklists for our intrusion prevention systems. |
| Let’s Encrypt | Internal ops | Public TLS certificate authority | 🇺🇸 United States | Issues TLS certificates for public domain names. |
| 3. Corporate & commercial processors (business contact & billing data) | ||||
| Google Workspace | Corporate | Corporate email, calendar, and shared documents | 🇮🇪 Ireland🇺🇸 United States | Used for business correspondence, calendar invitations, and team sign-in. |
| Fibery | Corporate | Internal documentation and project workspace | 🇨🇾 Cyprus🇮🇪 Ireland (EU host) | Used for internal documentation, project management, and client onboarding notes. |
| NeetoCal | Corporate | Online meeting scheduling | 🇺🇸 United States | Processes your name, email address, and meeting time when you book a call online. |
| SignRequest | Corporate | Electronic contract and NDA signatures | 🇳🇱 Netherlands | Processes electronic signatures on NDAs, Data Processing Agreements, and service contracts. |
| Xero & GoCardless | Corporate | Accounting, invoicing, and B2B payments | 🇬🇧 United Kingdom🇪🇺 European Union | Processes company billing contacts, invoices, and B2B payments. |
| Anthropic | Internal ops & corporate | AI engineering and operational assistance | 🇮🇪 Ireland🇺🇸 United States | Used under commercial API terms (with model training opted out) to assist our team with engineering and administrative workflows. |
| Mistral AI | Corporate | Document text extraction (OCR) | 🇫🇷 France | EU-hosted service used to extract text from business and compliance documents. |
Website privacy & your rights.
When you browse lithus.eu, book a discovery call, or become a client, Lithus UK Ltd acts as the data controller for business contact and billing details under UK and EU GDPR.
Zero cookies, zero trackers.
- We do not set tracking cookies, advertising pixels, or session-replay scripts.
- All fonts and assets are self-hosted directly on our domain so your browser makes zero requests to third-party CDNs on page load.
- Standard web server access logs (IP address, request path, timestamp) are kept briefly for security and DDoS mitigation and are never sold or shared.
How we handle your business contact data.
- We only collect your name, work email, and company details when you book a call, email us, or ask us to check back before your contract renewal.
- We never sell contact lists, run third-party ad retargeting, or enrol prospects in automated marketing drip sequences.
- You can request access to, correction of, or deletion of your business contact details at any time by emailing [email protected].
Lithus UK Ltd (established in the UK in 2007), with German GmbH formation completing in Q1 2027.
Every managed platform agreement includes a tailored GDPR Data Processing Agreement (Article 28) locking in your agreed subprocessor list and 30-day advance change notice.
Deployed in ISO 27001-certified EU data centres today, with Lithus’s own ISO 27001 certification completing in Q1 2027 (Stage 1 audit in November 2026).
For security questionnaires, DPA requests, or GDPR access/deletion requests, email [email protected].
Talk directly with an engineer who runs production clusters.
- 1Book a 30-minute call with one of our engineers to walk through your current stack
- 2Optionally share a recent cloud bill so we can model your exact hardware and savings
- 3Receive a costed migration plan, a fixed monthly price, and a candid view on whether we are a good fit
Locked into a cloud contract right now? Ask us to check back in 3, 6, or 12 months →