Subprocessors
The current, maintained list of every third party service Layout uses is published at layout.link/subprocessors. That page is the one to cite, and it is the one we keep up to date.
This page is the part a reviewer usually wants next: what each kind of service can actually see.
What each category touches
| Job | Sees |
|---|---|
| Cloud hosting and databases | Everything we store, encrypted at rest. Our own code runs here. |
| Card vault and card issuing | Your card number. We hold a token instead, and the vault is where the number itself stays. |
| Payment processing | The authorization on your card for an order you confirmed, plus membership and fee charges. |
| Identity | Your phone number and the sign in code sent to it. |
| Text messaging | Your phone number and the message body. |
| Cloud browsers | The restaurant's site during an order, plus the checkout fields for that order. |
| Residential proxies | Network traffic to the restaurant's site. |
| AI model calls | The order and menu text needed to complete one order. No card data, ever. |
| Help center and support | Your support conversations, and your email or phone if you contact us. |
| Frontend hosting | The pages you load. No database credentials, by design. |
| Point of sale platforms | Nothing today. These are integrations under development. |
| Brand logos | The restaurant's domain name, so we can show their logo. |
The two that matter most
The card vault. Card data lives inside a payment provider's PCI compliant vault, and it reaches them from your browser or app without passing through our servers. This is the arrangement that keeps our own compliance scope narrow by design rather than by good intentions. Which provider that is today is on the subprocessor list, because that list is maintained and a document like this one goes stale. See card data.
The model. A model is used to read menus and drive a restaurant's own checkout. What it receives is the text of the page it is working on and the order it is filling. Card numbers are never in a prompt, a task description, or a trace: the part of the system that fills in a card gets it separately and writes down only the last four digits.
How we bound them
- Each service does one job, and the list says which. A vendor added for a second job gets added to the list again.
- Anything sensitive is fetched per use rather than sitting in an environment file. There are no
.envfiles in this platform and secrets live in a managed store, which is enforced in our build rather than asked for in a code review. - Our own infrastructure runs in the United States. Where a vendor's own regions matter to you, ask and we will tell you which one we are on rather than guess in a document.
Business customers
The DPA is the binding document, and the subprocessor list is incorporated by reference from it. If you need notice of changes to that list, ask at contact@layout.link and we will add you.
Updated September 2, 2026