Legal
Subprocessors. Who handles what.
The vendors that handle customer data on Lucent's behalf, what each one does, and the kind of data it sees. Optional vendors receive data only when a feature is switched on.
- Last updated October 15, 2026
Always in the stack
The platform depends on these to run, for every organization.
| Vendor | What it does for us | Data it handles | Region |
|---|---|---|---|
| Supabase | Database, authentication and file storage. | Everything stored in the platform: account and sign-in records, and the properties, leases, ledger entries, work orders, messages, documents and photos an organization keeps. | United States (us-east-1) |
| Vercel | Application hosting and delivery, plus page-view and performance measurement. | Web requests and their metadata (such as IP address and browser), application logs, and anonymous page-view and performance measurements. | United States (functions in iad1); content is delivered from a global network |
| Inngest | Background jobs and workflow execution for automations and scheduled work. | Event data for background jobs, typically record identifiers and workflow settings, plus whatever content a given job must process. | Set by the provider |
| Cloudflare | DNS for the platform domain, and bot checks (Turnstile) on public forms. | DNS queries. Where the bot check is switched on: a challenge token with IP address and browser signals from the visitor’s submission. | Global network |
| Resend | Sign-in emails (magic links and codes), and the platform’s own transactional email when Postmark is not configured. | Recipient email address and the content of the message being sent. | United States (us-east-1) |
Optional, per feature
These receive data only when an organization uses the feature that needs them and the deployment has them configured. An organization that does not use a feature sends nothing to its vendor.
| Vendor | What it does for us | When it is used | Data it handles | Region |
|---|---|---|---|---|
| Postmark | Application email: invitations, receipts, notices and the messages an organization sends through the platform. Also receives inbound email. | Used once an email sending key is configured for the deployment. | Names, email addresses and message content. | Set by the provider |
| Stripe | Subscription billing for the platform, and payment processing for rent and other charges when an organization connects payments. | Billing and payments features, once Stripe is configured. | Billing contact, plan and door count; payer name, email and amount; payment method details, which Stripe collects directly (card numbers do not reach our systems). | Set by the provider |
| Plaid | Bank account connections used for owner payouts and ACH. | Only when an organization enables bank-account payouts or ACH. | Bank account and institution identifiers and access tokens. Bank credentials are entered into Plaid’s own interface; we do not store them. | Set by the provider |
| Twilio | Text messaging for notifications and conversations, including opt-out handling. | Only when an organization uses text messaging and Twilio is configured. | Phone numbers and message content. | Set by the provider |
| Mapbox | Address search and map display. | Only where a map token is configured; address fields work without it. | The address text typed into address fields and the locations shown on maps. | Set by the provider |
| Anthropic | Language-model provider behind AI features such as drafted replies, maintenance triage and the Copilot. | Only for organizations that turn AI features on, once an API key is configured. | The text an AI feature is asked to work on, such as message threads, work-order descriptions and record context. | Set by the provider |
| OpenAI | Speech-to-text for voice notes. | Only when voice-note transcription is used and an API key is configured. | Voice-note audio. | Set by the provider |
| Seam | Smart-lock connections for short-term rental stays. | Only for short-term rentals where an organization connects a smart lock. | Lock device identifiers and time-limited access codes for stays. | Set by the provider |
| Channex | Channel-manager connection for short-term rental listings. | Only for short-term rentals where an organization connects a channel manager. | Rental listing details, rates and availability, and reservation details including guest names and stay dates. | Set by the provider |
| Sign in with Google, and wallet passes for short-term rental guests. | Only where Google sign-in is switched on, or an organization offers wallet passes. | For sign-in: the name and email on the Google account. For wallet passes: stay details placed on the pass. | Set by the provider |
- This is a list of vendors, not a certification. We do not hold a third-party security attestation; the security page says so plainly.
- How we handle information, including the rights people have over it, is in the privacy notice. Terms are in the terms of service.
- Questions about a vendor, or need something for a security review? Ask us.