Who we share data with — the whole list, kept current.
Every vendor that touches your families' data is listed below. The list is public, versioned, and never changes quietly: super-admins get 30 days' advance notice before we add a subprocessor. We keep the list short on purpose, because the product is narrow.
Current subprocessors
5 activeMicrosoft Azure
United StatesCompute, storage, Azure SQL database hosting, CDN/WAF, and real-time messaging.
Azure Communication Services
United StatesTransactional email delivery — invitations, password resets, and notifications.
Stripe
United StatesSubscription billing, plus payment processing for commitment buyouts and fundraisers.
Anthropic
United StatesAI content moderation for messages and knowledge-base search. Content sent for screening is not used to train models.
Microsoft Application Insights
United StatesOperational telemetry, diagnostics, and performance monitoring. No family-directory PII in payloads.
How changes work
We treat the subprocessor list as a contract, not a footnote. Before any vendor is added, super-admins are notified 30 days in advance — enough time to ask questions or escalate through your own review process.
- 30-day advance notice to super-admins before any addition
- Removals and scope reductions take effect immediately and are logged here
- Every change is recorded in the versioned changelog below
Subscribe by email or RSS. To opt in by email, send a note to security@lumicura.org and we'll add you to the notification list.
Versioned changelog
-
Initial published subprocessor list: Microsoft Azure, Azure Communication Services, Stripe, Anthropic, and Microsoft Application Insights.
Future additions and removals will be appended here, newest first, with the same version-and-date format.
Looking for the bigger picture? See our security overview for how the data is protected, and the privacy policy for what we collect and why.