Sub-processors.
Lydira uses the following third parties to deliver the service. Maintained per GDPR Art. 28, KVKK Art. 8–9 and the Enterprise DPA addendum.
last updated · 2026-10-18
- dpa ↗
Amazon Web Services
Hosting for the whole platform: application servers, the database, file storage and backups. Each workspace lives in one cell, chosen by the country it signs up from, and its data stays in that cell.
- data types
- customer PII · trip data · attachments · audit logs · backups
- region
- Türkiye: Istanbul Local Zone · EU: Frankfurt (eu-central-1) · US: N. Virginia (us-east-1)
- certifications
- SOC 2 Type II · ISO 27001 · ISO 27018 · PCI DSS
- dpa ↗
iyzico (iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş.)
Card payments in Türkiye for subscriptions and AI credit top-ups, by Visa and Mastercard. iyzico is a payment and e-money institution licensed by the Central Bank of the Republic of Türkiye (TCMB).
- data types
- billing contact · billing address · Turkish ID / tax number · IP address · payment method metadata
- region
- Türkiye
- certifications
- PCI DSS Level 1
- dpa ↗
Stripe, Inc.
Payment processing for subscriptions and AI credit top-ups outside Türkiye.
- data types
- billing contact · payment method metadata
- region
- US + EU (customer card network region)
- certifications
- PCI DSS Level 1 · SOC 2 Type II
- dpa ↗
OpenAI
AI inference for inbox drafts, voice-to-lead transcription, business-card OCR, proposal generation. Opt-out per account.
- data types
- prompt text · audio clips (Whisper) · image payloads (Vision)
- region
- US
- certifications
- SOC 2 Type II
- dpa ↗
Mailgun (Sinch)
Platform email: transactional delivery (sign-up verification, notifications, welcome series) and receiving the mail forwarded into Lydira (supplier bills, e-tickets, replies).
- data types
- email address · message body · attachments
- region
- EU
- certifications
- SOC 2 Type II · ISO 27001
- dpa ↗
Cloudflare
DNS, CDN, WAF, DDoS protection for the hosted SaaS surface, and cookieless visit counts for the marketing site (lydira.com).
- data types
- request metadata (IP, path, headers) · marketing-site page views (no cookies, no visitor identifier)
- region
- Global edge
- certifications
- SOC 2 Type II · ISO 27001
- dpa ↗
Sentry
Application error tracking, plus the distributed trace linking a browser error to the server request that caused it.
- data types
- stack traces · request metadata (scrubbed of PII)
- region
- EU (Germany)
- certifications
- SOC 2 Type II · ISO 27001
- dpa ↗
New Relic
Application performance monitoring: request and background-job timing, database query performance, scheduled-job check-ins, uptime checks and server health (CPU, memory, disk).
- data types
- performance telemetry · request metadata (scrubbed of PII) · error class names (no messages) · server metrics
- region
- EU (Germany)
- certifications
- SOC 2 Type II · ISO 27001
- dpa ↗
Google LLC (Google Analytics)
Visitor analytics for the public marketing site (lydira.com) only, and only after the visitor accepts (US: until they opt out). It never receives data from a Lydira account.
- data types
- site visitor identifiers (_ga cookies) · pages viewed · browser, device, approximate location
- region
- US + global
- certifications
- ISO 27001 · SOC 2 Type II
card payments
We accept Visa and Mastercard.
Card payments in Türkiye go through iyzico, and everywhere else through Stripe. The card networks process each transaction under their own rules, as independent controllers, so they are not Lydira sub-processors.
- Visa
- Mastercard
change policy
Material changes to this list are announced to Enterprise Customers at least 30 days before they take effect. Every change goes through Legal and Security review.
questions
Compliance question, signed-DPA request, or spotted something out of date? Email security@lydira.com.