Subprocessors

Last updated: July 30, 2026

Lantern uses the following third-party service providers (known as "subprocessors") to operate the Service. Each provider processes a specific, limited subset of user data as described below. This page is the authoritative list.

Current subprocessors

Resend

Provider: Resend, Inc. (Delaware, USA)
Service: Transactional email delivery
Data processed: Your email address, your display name, and the content of transactional emails we send you (account verification links and password reset links)
Purpose: Sending account verification emails and password reset emails
Data processing agreement: resend.com/legal/dpa

Google (Sign in with Google)

Provider: Google LLC (Delaware, USA)
Service: OAuth identity provider for the optional "Continue with Google" sign-in flow
Data processed: Only the Google profile fields you consent to at sign-in: your email address, your display name, your profile picture URL, and Google's opaque stable user ID (the "sub" claim). No Google data is processed if you do not use the "Continue with Google" button.
Purpose: Verifying you are the owner of the Google account so we can sign you in to Lantern. We do not read any other Google services (no Drive, Gmail, Calendar, Contacts, Photos, etc.).
Data processing agreement: cloud.google.com/terms/data-processing-addendum

Modal

Provider: Modal Labs, Inc. (Delaware, USA)
Service: Serverless GPU inference for the neural matcher (candela-2.2, SSCD, DINOv3, CopyNCE)
Data processed: Image bytes you upload at registration or verification are forwarded to Modal for embedding computation. Modal returns a numerical embedding vector (hundreds to thousands of floats) to Lantern; the embedding is stored in our database. Image bytes themselves are processed in a transient container on Modal and not retained by Modal or by Lantern after processing. No account identifiers or personal metadata (email, display name, wallet address) are sent to Modal.
Purpose: Computing neural embeddings that power Lantern's detection of cropped, flipped, recompressed, and filtered copies of registered works. These embeddings are the technical basis for the accuracy upgrade shipped in Protection Phase 1.
Data processing agreement: modal.com/legal/dpa
Model attribution: Lantern's primary matching model, candela-2.2, is a fine-tuned derivative of CopyNCE, released by Ant Group under the Apache License 2.0. See github.com/eddielyc/CopyNCE for the base model and license. The matcher also uses the unmodified CopyNCE model, DINOv3 (released by Meta AI Research under the DINOv3 license; see github.com/facebookresearch/dinov3), and SSCD.

DigitalOcean

Provider: DigitalOcean, LLC (New York, USA)
Service: Cloud hosting for the Lantern application server, managed PostgreSQL database, and object storage for image copies
Data processed: All account data we store (email, display name, encrypted wallet key, registration records, dispute history) resides on DigitalOcean infrastructure. DigitalOcean does not have application-level access to this data; they operate the underlying compute and storage. From the effective date of the upcoming retention change (see the notice at the top of our Privacy Policy), resized protection copies and preview thumbnails of registered works will also be stored in DigitalOcean Spaces object storage in the United States. That is not happening yet.
Purpose: Running the Lantern API and storing account data
Data processing agreement: digitalocean.com/legal/data-processing-agreement

Microsoft PhotoDNA

Provider: Microsoft Corporation (Washington, USA)
Service: Child-safety screening of image copies before storage. Applies from the effective date of the upcoming retention change (see the notice at the top of our Privacy Policy); no screening requests are being made yet.
Data processed: An irreversible numerical signature (roughly 1 KB) computed from the image on Lantern's own servers, using screening software Microsoft licenses to us. Only that signature is sent, to be checked against databases of known child sexual abuse material before Lantern stores any protection copy or preview thumbnail. The image itself never leaves our infrastructure, and the signature cannot be reversed to reconstruct it. No account identifiers (email, display name, wallet address) cross this boundary.
Purpose: Legally required child-safety screening for stored images. Nothing is stored unless the screen returns a clear result, so if the service is unreachable we keep no copy rather than keep an unscreened one.
Data processing agreement: PhotoDNA Cloud Service terms of use (Microsoft)

Base network public RPC endpoints

Provider: Coinbase Technologies, Inc. (public endpoint mainnet.base.org), with PublicNode (base.publicnode.com) as an automatic fallback for read operations
Service: Base blockchain RPC access (transaction relay and on-chain reads)
Data processed: When a registration is written to the Base blockchain, Lantern submits the transaction (content hash, metadata URI, creator wallet address, signature) through these endpoints. No email address, display name, or other personal identifiers cross this boundary; only the pseudonymous wallet address and the content hash, which are by design public on the blockchain anyway.
Purpose: Relaying on-chain registration transactions to the Base network and reading on-chain state for verification
Data processing agreement: Not applicable. These are public, unauthenticated RPC endpoints; Lantern holds no account with either operator, and every field transmitted becomes public blockchain data regardless of which endpoint carries it. Before July 16, 2026 this role was filled by Alchemy Insights, Inc. under their standard DPA; Alchemy no longer receives any Lantern traffic.

Changes to this list

When we add or remove a subprocessor, we will update this page and notify registered users by email at least 14 days in advance of the change, except in cases where immediate replacement is required to keep the Service operating.

Questions

Email contact@lantern-us.com with any questions about how your data is processed.