Sub-processors

Sub-processors

Each processes personal data on our documented instructions, under a data processing agreement with us. Where a vendor is incorporated in the United States, transfers rely on the EU–US Data Privacy Framework where the vendor is certified under it, and on Standard Contractual Clauses otherwise.

• Railway - application, scan-worker and queue hosting. Region europe-west4 (Amsterdam, Netherlands, EU); US-incorporated.
• Neon - PostgreSQL database. Frankfurt, Germany, EU (running on AWS eu-central-1); US-incorporated.
• Cloudflare - R2 object storage for scan artefacts (screenshots, report PDFs) and for encrypted database backups, both in buckets under Cloudflare's EU jurisdiction, and Turnstile on the public scan form. US-incorporated; EU–US Data Privacy Framework.
• Resend - transactional e-mail. EU region (sending via Amazon SES, AWS eu-west-1, Ireland); US-incorporated; Data Privacy Framework / Standard Contractual Clauses.
• Sentry - error monitoring, EU region; processes data only when error monitoring is enabled. US-incorporated; Data Privacy Framework / Standard Contractual Clauses.
• GitHub - runs the nightly encrypted backup job, and briefly holds the database dump during the run before it is encrypted and uploaded. US-incorporated; Data Privacy Framework / Standard Contractual Clauses.
• Google Ireland Limited - Google Analytics 4 on our public pages, only with the visitor's consent on the cookie banner. It is our processor for our own website analytics, under Google's data processing terms: it concerns visitors to our own website, not data we process for customers, so it is not a sub-processor of customer data under the data processing agreement. Google may transfer the data to the United States under the EU-US Data Privacy Framework.

Onward sub-processors

Amazon Web Services appears beneath two of the vendors above rather than in its own row: Neon's database runs on AWS eu-central-1 (Frankfurt) and Resend sends through Amazon SES on AWS eu-west-1 (Ireland). Both are EU regions. It is listed so the list reflects where data actually sits, not only who the contract names.

Independent controllers

Two parties process personal data in connection with the service for their own purposes, as independent controllers - they are not sub-processors, and their own privacy notices govern their processing:

• Stripe, with Link as merchant of record - payments, invoicing, receipts, refunds and disputes. Stripe Technology Europe, Limited is the EU acquiring entity.
• Google - sign-in, only for accounts that choose it.

Changes to this list

Changes are announced on this page at least 30 days before they take effect; if you object and we cannot resolve it, you may terminate without penalty. The data processing agreement at /legal/dpa carries the full change process.

Questions about this list go to [email protected].

Changelog

• 26 September 2026 - scan artefacts (screenshots, report PDFs) moved to a Cloudflare R2 bucket under Cloudflare's EU jurisdiction, where the backups already were. Same vendor, no new sub-processor.
• 25 September 2026 - Google Ireland Limited added for Google Analytics 4 on our public pages, only with consent. It concerns visitors to our own website, not data we process for customers.
• 30 August 2026 - first published version: Railway, Neon, Cloudflare, Resend, Sentry and GitHub as sub-processors; AWS named as onward sub-processor; Stripe/Link and Google listed as independent controllers.