You are asking because you want to know three things: how locked in you are, what happens if Lath stops existing, and who can read your data. Those are the right questions. A list of supplier names answers none of them.
The entitlement layer, the control plane, the operation registry and the audit log. This is the product — one customer identity, one resolution order, one append-only record of every mutation. None of it is bought, because there is nothing to buy: the whole reason Lath exists is that this layer is missing from every combination of the parts below.
compute isolates, per request, multi-region object storage backups, exports, static assets managed Postgres your database, your connection string mail delivery transactional send and inbound card processing acquiring, disputes, payouts domain registry registration and DNS
We do not publish which suppliers those are, and the reason is not secrecy. They change, and your price does not. Publishing the list would make a stable service look unstable every time a workload moved, and it would turn a migration you never noticed into a support conversation.
It would also be the wrong number to reason about. What matters is not who runs the metal but whether you can leave — and that is answerable precisely.
Three things, and lock-in turns on all three rather than on any of the names above.
a real connection string standard Postgres · your client, your migrations a domain you own registered to you · transferable at any time a full export customers, access, grants, operations, invoices
The database is not an abstraction over Postgres — it is Postgres, and the connection string works from anything that speaks the protocol. The export is JSON, one file per resource type, and it excludes secrets because secrets are vault handles rather than values.
To send authenticated mail from your domain, your DNS has to publish a record delegating signing. That record names the host doing the signing, and it lives in a zone we do not control the presentation of.
So a provider hostname is visible in your own zone file, and no amount of proxying changes that.
We would rather you read it here than discover it yourself and wonder what else was omitted. It disappears when Lath signs with its own keys, which is work that is not done.
Secrets — connection credentials, API keys, signing material — are stored as vault references rather than values. Lath cannot read them back, which is also why a lost API key is rotated rather than recovered: if support could retrieve it, it was being stored.