Subprocessors
The maintained list of third party services Layout uses is published at layout.link/subprocessors. This page is the part a reviewer usually wants next: what each service that handles personal data can actually see.
What each one sees
| Service | Job | Sees |
|---|---|---|
| Amazon Web Services | Hosting, databases, secrets | Everything we store. Our own code runs here. |
| Cloudflare | DNS, network edge, storage for receipt screenshots | Traffic to our domains, and the confirmation screenshots on receipts. |
| Vercel | Hosting for our web pages | The pages you load. |
| Stripe | Card vault, holds and charges on your card, Layout One | Your card number, which is where it stays, and every charge we make to it. |
| Mercury | Issues the cards Layout pays restaurants with | The restaurant's charge on Layout's card. Nothing about your card. |
| Auth0 | Sign in | Your phone number and the sign in code sent to it. |
| Twilio | Text messages | Your phone number and the text of each message. |
| Resend | Your email address and the email we send you. | |
| Apple | Push notifications and device checks for the iPhone app | A device token and the text of each notification. |
| Gemini model calls, Places lookups, and a bot check at sign in | The order, menu and chat text a model needs, the places and areas searched, and the sign in page's bot signal. No card data, ever. | |
| Browserbase | The cloud browsers that open a restaurant's site | The restaurant's site during an order, and the checkout fields for that order. |
| A residential proxy network | Network routing for those browsers | Traffic between the browser and the restaurant's site. |
| PostHog | Product analytics | Usage events and masked web session recordings, keyed to a pseudonym, without payment details. |
| Intercom | Help center and support | Your support conversations, and your email or phone if you contact us. |
| Slack | Our internal alerts | Details of an order that needs a person to look at it, with card data scrubbed from every message. |
| Uber Direct | A courier partner, for orders it carries | The order and the contact details it needs for those orders. |
Some services on the published list see no personal data, such as the one that supplies restaurant logos and the one that hosts our code.
The two that matter most
The card vault. Your card number lives inside Stripe's vault, and it reaches Stripe from your browser or app without passing through our servers. This arrangement keeps our own compliance scope narrow by design rather than by good intentions. See card data.
The model. A model is used to understand requests, read menus and drive a restaurant's own checkout. What it receives is the text of the page it is working on and the order it is filling. Card numbers are never in a prompt, a task description or a trace: the part of the system that fills in a card gets it separately and writes down only the last four digits.
How we bound them
- Credentials for each service are read from a managed secret store when they are used, rather than kept in environment files.
- Our cloud infrastructure runs in AWS's US East region. Where a vendor's own regions matter to you, ask and we will tell you which one we are on rather than guess in a document.
Business customers
The DPA is the binding document for business customers. To be told about changes to the subprocessor list, ask at contact@layout.link and we will add you.
Updated October 21, 2026