Who handles your data, and how we customise your supply chain.
Hyperscalers and multi-tenant SaaS platforms force you to accept dozens of fixed subprocessors. Because every Lithus client runs on dedicated European servers, we keep the supplier chain short — and we agree and customise the exact subprocessor list with you before we deploy.
Three distinct scopes — and a cluster architecture shaped around your compliance needs.
Security and procurement teams need a clear boundary between suppliers that can touch customer workloads, internal tools that never see your data, and corporate tools used when you visit our website or sign a contract.
Agreed & customisable per cluster
Every client cluster is single-tenant. Together with your team, we choose the European data centre operator (Germany, the Netherlands, or France), where encrypted off-site backups are stored, and which operational integrations are enabled.
Zero access to your workload data
We use tools like Tailscale (peer-to-peer WireGuard encrypted), 1Password (end-to-end encrypted), and Twilio/Telnyx (on-call paging) to run our engineering team without granting those vendors access to your servers or databases.
No tracking cookies or ad networks
This website serves static HTML and self-hosted fonts with zero third-party analytics or tracking cookies. Corporate processors are only involved when you book a call, sign a contract, or pay an invoice.
Example subprocessors for a managed client cluster.
The table below shows a typical production cluster configuration. Because there is no dependency on a proprietary hyperscaler control plane, each row can be tailored in collaboration with your compliance and engineering teams.
| Supplier | Role in the cluster | Location / HQ | How we customise this with you |
|---|---|---|---|
| Hetzner / Worldstream / OVHcloud | Dedicated bare-metal servers, private network, and ISO 27001-certified data centre facilities | 🇩🇪 Germany · 🇳🇱 Netherlands · 🇫🇷 France | You choose the EU jurisdiction and operator (for example Worldstream in Naaldwijk, Hetzner in Falkenstein/Nuremberg, or dual-site EU colocation). Named client contacts can also receive direct emergency portal authorisation. |
| OVHcloud | Encrypted off-site backups (all encryption keys are held inside your cluster; the storage provider never holds keys) | 🇫🇷 France | We can route off-site backups to another EU provider of your choice, or write secondary backups directly to a storage account owned in your company’s name. |
| Exoscale | Lithus core operations plane: secrets management, Forgejo code hosting, alerting plane, and access bastion | 🇨🇭 Switzerland (A1 Digital) | Hosted in Switzerland under European jurisdiction. Monitoring and log storage can also be kept strictly in-cluster on your own dedicated hardware. |
| Scaleway | EU-hosted AI model used to assist engineers with alert triage | 🇫🇷 France | Optional. Can be disabled completely for your cluster if your security policy or customer contracts prohibit automated alert triage. |
| Slack / Microsoft Teams | Shared engineering channel and alert notifications with your team | 🇺🇸 United States / 🇪🇺 EU residency | We work inside whichever chat platform your engineers already use, or route alerts exclusively through self-hosted endpoints without payload PII. |
Suppliers used by Lithus without access to client workload data.
To give your procurement and security teams a complete view of our supply chain during due diligence, we also disclose the internal tools our engineers use that do not process or have access to your customer data.
| Supplier | Role | Why client data is not exposed | Location / HQ |
|---|---|---|---|
| Tailscale | Private network coordination | Control plane coordinates node keys only; all traffic between engineers and clusters is peer-to-peer WireGuard encrypted | United States |
| Twilio & Telnyx | Voice and SMS paging to the on-call engineer | Receives only high-level wake-up alerts for our on-call rotation; no customer data or database payloads | United States |
| 1Password | Operational credential vault | End-to-end encrypted vault; the vendor cannot decrypt stored secrets | Canada |
| Google Workspace | Lithus corporate email and engineer identity | Used for business communication and SSO identity; no production workload hosting | United States |
| Google Cloud | Lithus internal software build pipeline | Compiles internal Lithus tooling and images only; never processes client databases or traffic | United States |
| Docker Hub & GitHub | Upstream open-source container images and build tools | Pulled as public/upstream software artefacts; no client data leaves the cluster | United States |
| Let’s Encrypt | Public TLS certificate issuance | Receives public domain names only during ACME certificate validation | United States (non-profit) |
Website privacy & corporate subprocessors.
When you browse lithus.eu, book a discovery call, or become a client, Lithus UK Ltd acts as the data controller for business contact and billing details under UK and EU GDPR.
Zero cookies, zero trackers.
- We do not set tracking cookies, advertising pixels, or session-replay scripts.
- All fonts and assets are self-hosted directly on our domain so your browser makes zero requests to third-party CDNs on page load.
- Standard web server access logs (IP address, request path, timestamp) are kept briefly for security and DDoS mitigation and are never sold or shared.
Corporate tools we use for business contact data.
- NeetoCal (United States) — Processes your name, email address, and meeting time if you use our online scheduling link to book a call.
- Google Workspace (United States) — Processes email correspondence, calendar invitations, and shared proposal documents.
- SignRequest (Netherlands) — Processes electronic signatures on NDAs, Data Processing Agreements (DPAs), and service contracts in the EU.
- Xero, Stripe & GoCardless (UK / EU / US) — Processes company billing contacts, invoices, and B2B payments.
Lithus UK Ltd (established in the UK in 2007), with German GmbH formation completing in Q1 2027.
Every managed platform agreement includes a tailored GDPR Data Processing Agreement (Article 28) locking in your agreed subprocessor list and 30-day advance change notice.
Deployed in ISO 27001-certified EU data centres today, with Lithus’s own ISO 27001 certification completing in Q1 2027 (Stage 1 audit in November 2026).
For security questionnaires, DPA requests, or GDPR access/deletion requests, email contact@lithus.eu.
Talk directly with an engineer who runs production clusters.
- 1Book a 30-minute call with one of our engineers to walk through your current stack
- 2Optionally share a recent cloud bill so we can model your exact hardware and savings
- 3Receive a costed migration plan, a fixed monthly price, and a candid view on whether we are a good fit
Locked into a cloud contract right now? Ask us to check back in 3, 6, or 12 months →