Trust
Sub-processors
Every third party that processes customer data on our behalf, what it is used for, and what it can actually see. Published rather than held back until procurement asks.
Last updated 1 November 2026
| Processor | Purpose | Location | What it can see |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Frankfurt, Germany (eu-central-1) | All workspace data: deals, contacts, activity, uploaded documents |
| Vercel | Application hosting and server functions | Frankfurt, Germany (fra1) | Data in transit while a page or API call is being served |
| Anthropic | AI drafting, summarising (including meeting transcripts you paste) and research, where you ask for it, and tidying a contact spreadsheet you import | United States | The project context for the drafts, summaries and research you ask for, a mandate letter you ask it to read for its terms, and a meeting transcript you paste to turn into notes. The rows of a contact spreadsheet you import into the Investor log, every column as it is in the sheet, which it tidies - for a sheet of up to 300 rows; a longer sheet is read by fixed rules, with no AI. Not used to train models. |
| TypeSafe AI | Reading email from your project contacts, and replies to your outreach from their colleagues at the same firm written from the firm's own company domain, to set each contact's status (the Jev model), only on projects where automatic reply status is switched on | United States | On those projects only: the subject and text of each email one of the project's contacts sent to your connected mailbox in the last 14 days, other than those recognised as automatic replies, with the names of its attachments, the project codename, the client's name and that contact's current status. Never the attachments themselves, and no mail from anyone who is not a contact on the project, except a reply to your outreach from someone at one of the project's firms, written from that firm's own company domain, which is read as that firm's reply. E-signature notices and the mail you sent, read on those projects to record a signed NDA or a CIM, are read on our own server by fixed rules and are not sent to TypeSafe AI. Its terms bar training on this text without our consent, which we have not given, but let it use telemetry from it - logs, classifications, metrics and learnings - without restriction. |
| RocketReach | Finding people at a firm and their work address, where you ask for it | United States | Only the firm name, and the person's name or role when you give one, for that one search. No deal data, no contact list. |
| Anymail Finder | Finding a named person's work address, where you ask for it | United States, with backup hosting in Germany | Only the person's name and the company's domain or name, for that one search. No deal data, no contact list, and nothing that says which customer or mandate asked. Its terms let it use search data for its own commercial purposes, keep each search for up to 12 months, and, on request, tell a searched person that our account searched for them. |
| Resend | Our own transactional email: team invites, access decisions, document alerts and reply alerts | Ireland (EU) | The recipient's name and email address and the text of that one message. A document alert names the counterparty who opened a tracked document or accepted your confidentiality wording, their firm, the document type and the time - never the mandate, the client or the file name. A reply alert names the counterparty who replied, their firm and the time, and an alert that an investor has gone quiet names them, their firm and how many days - never the mandate, the client or the text of the email. Never your outreach, which does not pass through us at all. |
| Stripe | Payment processing, if and when you subscribe | United States and Ireland | Billing details only. No deal data. |
Your outreach has no mail sub-processor
Your outreach has no mail sub-processor. It is sent directly from your own mailbox - through Microsoft Graph, the Gmail API, or your firm's own SMTP server - using credentials encrypted with AES-256-GCM that are decrypted only on our server. Nothing you send to a counterparty is relayed through DealLaunch infrastructure, which means your firm's existing journaling and archiving still capture every message. Each outreach email carries a 1x1 image from DealLaunch, and when the recipient's mail app loads it we record the time against that contact and that email - never their IP address or browser. Our own transactional email - a team invite, telling somebody their access was approved, or a document or reply alert you have not switched off - is sent through Resend, a listed sub-processor. It carries no deal data, except that a document alert names the counterparty, their firm and the document type, and a reply alert names the counterparty and their firm. Replies are a different path: when replies are checked - when you open Outreach, and every 10 minutes on our server for a mailbox connected through Microsoft or with an app password - our server reads email from your project contacts in your mailbox and saves its subject and opening text on the contact's record, and on a project where automatic reply status is switched on it also sends that email's subject and text, with the names of its attachments (never the files), to TypeSafe AI, a listed sub-processor, to set the contact's status. It treats a reply to your outreach from someone else at the contact's firm, written from that firm's own company domain, the same way, as that firm's reply. On those projects our server also reads, itself and with no AI, e-signature notices about your project contacts and the mail you sent them - for its recipients, subject, attachment names and DealLaunch links - to record a signed NDA or a CIM.
Changes to this list
We will give customers at least 30 days' notice by email before adding a sub-processor that can access workspace data, and this page will be updated on the same day. If you object to a new sub-processor you may terminate without penalty and export your data. To be notified, write to hello@deallaunch.ai.