This registry identifies service providers that may process Personal Information for Level. A provider receives only the information needed for its role and only when the applicable product, feature, or business process uses that provider.
Not every provider below is a subprocessor for every customer. Advertising providers may act as independent businesses or controllers rather than processors. Customer-directed integrations are not Level subprocessors merely because a customer connects them.
Infrastructure, Storage, and Delivery
- Advanced Data: primary backend data center services in Asheville, North Carolina, United States.
- Bunny.net (BunnyCDN): content delivery and storage.
- Wasabi: object storage.
- Vultr: cloud infrastructure; Level currently uses United States locations.
- Hetzner: data center and cloud infrastructure; Level currently uses United States locations.
- Vercel: distributed frontend and website hosting, serverless infrastructure, content delivery, and content storage. Its delivery network operates globally; this is not a United States-only processing commitment.
- Neon: website content database infrastructure.
- Ably: real-time messaging infrastructure.
Customer Operations and Communications
- Stripe: payment processing and subscription management.
- Intercom: customer support and documentation.
- Mailgun: email delivery.
- Twilio: SMS delivery and network traversal services.
- Microsoft: business email, calendar, meetings, and collaboration.
- Basecamp by 37signals: project and support collaboration.
- MeetingBaaS: meeting recording and transcription when enabled.
Security, Reliability, and Product Analytics
- Sentry: error reporting.
- AppSignal: application performance monitoring.
- Mezmo: centralized logging.
- ipstack: IP geolocation and security signals.
- Segment: product analytics and marketing website data routing.
- PostHog: marketing website analytics and campaign measurement.
- Google Tag Manager and Google Analytics: marketing website tag management, analytics, and campaign measurement.
Artificial Intelligence Services
- Anthropic, OpenAI, OpenRouter, and xAI: model and routing services selected according to the enabled feature or task.
Advertising and Campaign Measurement
Level uses Google advertising services and Reddit on the marketing website for campaign measurement and advertising. Depending on the provider, configuration, and applicable law, these providers may act as independent businesses or controllers. They are not used to observe Customer Content or Endpoint activity in the authenticated Level product.
Processing Scope and Locations
The infrastructure roles above may involve hosted device and account metadata, operational records, or customer-provided content, depending on the service. Hosting and delivery can also involve request, network, and connection metadata. Metadata can be Personal Information; the absence of customer-uploaded files does not make it exempt from data-protection obligations.
The United States locations stated above describe Level’s current Advanced Data, Vultr, and Hetzner deployments, not every location offered by those providers or used by other providers in this registry. Storage, delivery, support, and other processing locations may differ. For the countries, data categories, and provider roles relevant to a particular service or account, contact support@level.io.
The Privacy Policy describes international-transfer safeguards. An executed Data Processing Addendum governs required transfer authorizations and subprocessor notices. Listing a provider or changing this registry does not itself authorize a new transfer or override those requirements.
Changes and Notice
Level updates this registry when a provider is added, removed, or assigned a materially different processing role. Notice and objection rights for a new or replacement subprocessor are governed by the customer’s executed Data Processing Addendum. Where that agreement requires 30 calendar days’ advance written notice to the designated DPA notice email, Level must provide that notice before engaging the new or replacement subprocessor. Updating this page alone does not satisfy that requirement. Existing notice periods and objection rights are not shortened by this registry.
Customers without an executed Data Processing Addendum may request subprocessor-update notices by emailing support@level.io. The request should identify the Level workspace and the email address that should receive notices.
Revision History
- October 9, 2026: Added Hetzner to the disclosed infrastructure providers; clarified current United States backend and infrastructure locations, distributed Vercel processing, metadata scope, and contractual notice and authorization requirements. This entry does not establish when any provider was first engaged or replace any required notice.
- August 24, 2026: Initial standalone registry. The providers previously listed in the Privacy Policy were moved here without changing their stated roles.
Contact
Questions about this registry or requests for a Data Processing Addendum may be sent to support@level.io.