Sub-processors
Mahleon uses the sub-processors below to deliver the service. We disclose every party that may process customer or prospect data.
LinkedIn is not a sub-processor and is not listed. It is the source of prospect data, not a party processing data on Mahleon's instructions. Mahleon never signs in to LinkedIn on your behalf: outreach runs in your own browser, in your own session, on your own device, and our servers hold no LinkedIn credentials or session cookies.
| Sub-processor | Purpose | Location | Data |
|---|---|---|---|
| Supabase | Application database, auth, file storage | EU (Frankfurt) | Customer + prospect data |
| Fly.io | Outreach orchestration engine (compute) | United Kingdom (London) | Prospect data in transit |
| Salesforce | CRM dedup (only if the customer connects it) | Customer's instance (EU or US, per their edition) | Prospect identifiers for matching |
| Resend | Transactional email (auth + alerts) | United States | Email address only — no prospect PII in bodies |
| Vercel | Web application hosting | EU region | Application traffic |
Customer and prospect data stays on UK and EU infrastructure. Transactional email is the exception: it is sent from Ireland, and delivery logs are held in the United States by our email provider. Those logs carry a recipient address and a subject line and never a prospect's details. When a customer connects Salesforce, Mahleon calls only that customer's own instance — an EU Salesforce edition keeps the data in the EU. Material changes to this list are notified to customers in advance.
Last updated: 29 June 2026.