Leash

Service providers and subprocessors

Last updated: October 27, 2026

This page identifies external services visible in the current Leash product and deployment configuration. A provider's legal role may be processor, subprocessor, or independent controller depending on the service and customer relationship. The list is not a certification or a promise that every optional integration is enabled for every account.

ProviderPurposeData involved
Google Cloud PlatformHosted application and API infrastructure, Firebase Authentication, and push notificationsCloud account, device, security-event, approval, organization, and operational data needed by the deployed service
OpenAIBusiness company-name extractionPublic company-site signals used to identify a new workspace
TypeSafe (JEV)Shared security evaluations for configured Leash protectionsRelevant action inputs, results, reason and task context needed to evaluate requests through Leash, which may include connected-account data
Lemon SqueezySubscription checkout, billing, and merchant-of-record servicesBilling contact, subscription, order, and payment-related information
Google AnalyticsPublic website analyticsPage, referral, approximate location, browser, and device analytics described in the Privacy Policy
Google, Microsoft, and GitHubAccount sign-in where the user selects one of these identity providersAuthentication identifiers, name, email, and provider metadata returned by the selected sign-in flow
GitHubPrivate source hosting and official release distributionSource and release artifacts; download requests are also subject to GitHub's own service terms and logs

AI services you connect

When you connect ChatGPT, Claude or another AI client, Leash returns the results you request to that service. These user-selected recipients are separate from Leash’s managed service providers. These AI services handle received content under their own terms, privacy policies and account settings. Leash does not control their settings.

TypeSafe’s Privacy Policy and data-handling guidance state that customer requests and responses are not used to train JEV. We do not claim that our account has zero data retention; retention and deletion depend on the applicable terms and any separately agreed arrangement.

Changes to this list

We update this page when a material hosted dependency changes. Business customers with contractual notice requirements should confirm those terms in writing; this public page alone is not a guaranteed advance-notice service. Questions can be sent to privacy@openleash.com.

Data processing agreements

Leash does not currently publish a pre-signed DPA template. If your organization requires a DPA, contact privacy@openleash.com before sending production organization data and confirm the applicable terms in writing.

Related information