| Hetzner Online GmbH | Production hosting infrastructure (compute, storage, networking) for the EU region | Germany | Germany (Nuremberg / Falkenstein) |
| Hetzner Online GmbH | Production hosting infrastructure (compute, storage, networking) for the US region | Germany | United States (Ashburn, VA / Hillsboro, OR) |
| Postmark (ActiveCampaign, LLC) | Transactional email delivery (verification, password reset, security notifications, admin alerts) | United States | United States |
| Google LLC — Firebase Cloud Messaging (FCM) | Delivery of push-authentication prompts to Android devices and, on Customer request, web push | United States | Global (per FCM’s published regions) |
| Apple Inc. — Apple Push Notification service (APNs) | Delivery of push-authentication prompts to iOS devices | United States | Global (per APNs’ published regions) |
| Mistral AI SAS | AI-assisted features (policy authoring, theming, risk narrative), engaged only when the Customer enables these features in tenant configuration. The AI provider is selected and configured by LumoAuth at the platform level, not by the Customer. End-user authentication data is not sent to this Sub-processor. | France | European Union |