Sub-Processor List
Last updated: August 24, 2026
1. Overview
Universal Life Source (ULS) uses the following third-party services (sub-processors) to operate the platform. Each sub-processor processes data on our behalf as a data processor under the terms of our Data Processing Addendum.
We provide 30 days' notice before engaging any new sub-processor. Customers may object to a new sub-processor by contacting [email protected] within the notice period.
2. Current Sub-Processors
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| Logto | Authentication (OIDC identity provider) | Email, name, password (hashed by Logto) | United States |
| Cloudflare | CDN, TLS termination, DDoS protection, WAF, DNS | IP address, request metadata | United States |
| Railway | Application hosting and PostgreSQL database | All application and database data | United States (US East) |
| OpenAI | AI answer generation | Search query text and retrieved source passages (no account identifiers) | United States |
| NVIDIA | Query embeddings for semantic search | Search query text (no account identifiers) | United States |
| SendGrid | Transactional email delivery | Email address and email content | United States |
3. BYOK (Bring Your Own Key)
When a user configures BYOK, their AI provider API key is used instead of the ULS platform key for structured research capabilities. In this case:
- The user's API key is encrypted at rest and never stored in plaintext
- AI requests are sent directly to the user's chosen provider (OpenAI or Anthropic) using the user's own key
- ULS does not have access to the user's API key in plaintext except at the moment of use
- The user is responsible for their own provider relationship and data processing agreement with their AI provider
4. Notification of Changes
We will notify customers of any changes to this sub-processor list at least 30 days before engaging a new sub-processor. Notifications will be sent to the organization owner's email address and posted on this page.
To subscribe to sub-processor change notifications or to object to a proposed sub-processor, contact [email protected].
5. Contact
For questions about sub-processors or data processing, contact [email protected].