Sub-processors
Mahleon uses the sub-processors below to deliver the service. We disclose every party that may process customer or prospect data. LinkedIn is listed for transparency — it is the source of prospect data, not a sub-processor acting on Mahleon's instructions.
| Sub-processor | Purpose | Location | Data |
|---|---|---|---|
| Supabase | Application database, auth, file storage | EU (Frankfurt) | Customer + prospect data |
| Fly.io | LinkedIn automation engine (compute) | United Kingdom (London) | Session cookies, prospect data in transit |
| Residential proxy provider | Outbound network path for the engine | UK / EU egress | Network traffic only |
| Salesforce | CRM dedup (only if the customer connects it) | Customer's instance (EU or US, per their edition) | Prospect identifiers for matching |
| Resend | Transactional email (auth + alerts) | United States | Email address only — no prospect PII in bodies |
| Vercel | Web application hosting | EU region | Application traffic |
EU customer data stays on EU infrastructure. When a customer connects Salesforce, Mahleon calls only that customer's own instance — an EU Salesforce edition keeps the data in the EU. Material changes to this list are notified to customers in advance.
Last updated: 29 June 2026.