Subprocessors & Third-Party Services

1. How to read this page

Implest uses different types of external providers. Not every provider has the same legal role. A subprocessor processes Customer Personal Data on behalf of Implest; another provider may instead act as an independent controller, payment provider, data source or customer-directed integration.

The list below reflects the architecture used by Implest as of the date shown. A service is used only where relevant to the features enabled for a customer.

2. Core subprocessors

Supabase — managed database, authentication, Edge Functions and application infrastructure. The primary Implest production project is configured in the European Union (Ireland). Supabase or its own authorised subprocessors may perform additional processing as described in its contractual documentation.

Vercel — web application hosting, delivery and server-side application execution. Depending on the request, Vercel may process technical request data, session-related data and application data needed to deliver the Implest web service.

OpenAI — AI model inference and related AI processing used for analysis, generation, classification and agent workflows. For EEA customers, the applicable OpenAI contracting entity and transfer arrangements are governed by OpenAI’s business/API terms and Data Processing Addendum.

Unipile — connected messaging, account connectivity and communication events for supported channels such as LinkedIn and other enabled communication services.

Resend — transactional and operational email delivery, including recipient address, message content and delivery metadata needed to send and troubleshoot email.

Hetzner — optional infrastructure provider for self-hosted or auxiliary Implest services. Self-hosted software such as Activepieces is not treated as an external cloud processor merely because Implest operates the software; Hetzner is the infrastructure provider where that infrastructure processes personal data.

3. Payment provider

Stripe — payment, subscription, billing, invoicing and related fraud-prevention services. Stripe may act as a processor or independent controller depending on the processing activity. Implest does not treat full payment-card details as application data stored in its own database.

4. Customer-directed integrations

Google — calendar, identity and other Google services connected by the customer. Google processes data under the customer’s and Google’s applicable terms for the connected service.

Microsoft — calendar, identity and related Microsoft services when connected by a customer. The integration is used only when enabled.

HubSpot — CRM integration when a customer connects its own HubSpot account. Data may flow between Implest and the customer’s CRM according to the customer’s instructions.

5. Professional data providers

Apollo — professional B2B data discovery and enrichment where enabled. Apollo may act as an independent controller for professional contact information it provides and may have other roles for data submitted to its services.

Lusha — professional B2B data discovery and enrichment where enabled. Lusha may act as an independent controller for data from its own business-contact database and as a processor for certain customer-provided data, depending on the service.

6. Historical and inactive providers

Make.com is not part of Implest’s current active production processing architecture. As of 7 October 2026, no Implest scenarios in the connected Make workspace are active. Inactive and error-state legacy scenarios may remain temporarily while residual webhooks, connections and credentials are reviewed and decommissioned. Implest may retain limited historical records concerning the former use of a provider where needed for security, audit or legal compliance.

Activepieces is currently self-hosted software rather than an external cloud processing layer in the core Implest architecture. Production use, if introduced later, will be reflected in this page where it changes the processing chain.

7. Changes and objections

Implest may update this page as providers or features change. Where a new subprocessor materially affects Customer Personal Data and applicable law or contract requires notice, Implest will provide reasonable advance notice through the service, account contact or an updated subprocessor notice.

Customers with a reasonable data-protection objection to a new subprocessor may contact msegura@implest.com.