TopLeft subprocessors
TopLeft Technologies Ltd. uses the companies below to provide the TopLeft service. Each one processes personal data only to provide the service listed, under a written agreement with data protection terms at least as protective as our Data Processing Agreement.
We give at least 14 days' notice before adding or replacing a subprocessor. If one has to be replaced urgently, for security reasons or because it stops providing its service, we make the change and tell you as soon as we can. To get these notices by email, write to privacy@topleft.team with the subject "Subprocessor updates".
Where your data is hosted
Your instance runs in the region you chose. Its application, database, standby database, nightly backups and file storage stay in that region. Public images, such as member avatars and logos, are served through DigitalOcean's CDN.
| Region | Data stays in |
|---|---|
| United States | United States |
| Canada | Canada |
| European Union | European Union |
| Asia-Pacific | Asia-Pacific |
Infrastructure
| Subprocessor | Purpose | Personal data | Location |
|---|---|---|---|
| Akamai Technologies (Linode) | Application hosting and database | All customer data | The region you chose |
| OVH Groupe SA (OVHcloud) | Application hosting and database on dedicated region servers | All customer data | The region you chose |
| DigitalOcean, LLC | Standby database servers for failover, nightly backups, and file storage for images pasted into notes until they are copied to your PSA | All customer data | The region you chose |
| Cloudflare, Inc. | Network proxy, TLS and attack protection in front of the application | All data in transit | Global network |
| OVH Groupe SA (OVHcloud) | Central application log store, logs kept up to 7 days | User names, email addresses, IP addresses, record identifiers and fields that appear in logs | Canada |
| ActiveCampaign, LLC (Postmark) | Notification emails, including client portal emails | Recipient names and email addresses, message content | United States |
| Functional Software, Inc. (Sentry) | Error reporting | Signed-in user's identity and IP address, request details at the time of an error | United States |
AI features
AI features are optional. These subprocessors receive data only when AI features are on for your account. On the AI settings page you can set Anonymized for the whole account, or Anonymized or No AI for individual clients.
| Subprocessor | Purpose | Personal data | Location |
|---|---|---|---|
| OpenRouter, Inc. | Routes AI requests to the model provider, with zero data retention enforced on each request | Details of the tickets, projects and tasks the feature analyses. Under the Anonymized setting, client and people names are replaced with placeholders and notes are left out. Nothing is sent for a client set to No AI. | United States |
| Anthropic, PBC | AI model provider, reached through OpenRouter with zero data retention. Used when an Anthropic model is selected. | Details of the tickets, projects and tasks the feature analyses. Under the Anonymized setting, client and people names are replaced with placeholders and notes are left out. Nothing is sent for a client set to No AI. | United States |
| OpenAI, L.L.C. | AI model provider, reached through OpenRouter with zero data retention. Used when an OpenAI model is selected. | Details of the tickets, projects and tasks the feature analyses. Under the Anonymized setting, client and people names are replaced with placeholders and notes are left out. Nothing is sent for a client set to No AI. | United States |
If you connect your own Azure OpenAI resource instead, those requests go to Microsoft under your own agreement with Microsoft, and Microsoft is not our subprocessor for that processing.
Account, billing and product analytics
These receive data about TopLeft users (your staff who sign in), not the contents of your PSA.
| Subprocessor | Purpose | Personal data | Location |
|---|---|---|---|
| HubSpot, Inc. | Customer relationship management and account emails (invitations, password resets) | User names, email addresses, license type, company name | United States |
| Chargebee, Inc. | Subscription billing | Billing contact name, email address, billing address | United States |
| LaunchDarkly, Inc. | Feature flags | User name, email address, license type, company name | United States |
| PostHog, Inc. | Product usage analytics | User name, email address, pages and features used | United States |
Not subprocessors
Your PSA (ConnectWise, Autotask or HaloPSA) is your own vendor. TopLeft reads from and writes to it on your instructions, but the PSA vendor does not process data on TopLeft's behalf. The same goes for Microsoft Entra ID when you use it for single sign-on, and for your own Azure OpenAI resource.
Updated November 14, 2026
Comments
No comments yet.