Sub-processors
The third parties that process customer data on our behalf, what each one does, which data it sees and where, and how we announce a change.
1. Current sub-processors
| Provider | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Hostinger (hosting provider) | Dedicated virtual server hosting for the platform and its database | All customer data at rest and in transit on our servers; the provider operates the hardware and network, not the application | Mumbai, India | Hosting agreement; the server is operated by us; customer data is encrypted in backups; tenant isolation is enforced in our database |
| Google (Gmail SMTP) | Delivery of transactional email: sign-in and password messages, invitations, billing notices | Recipient address, subject and message body of each notification | Google infrastructure; location not fixed by the provider | Google’s standard terms. A transactional mail provider with a processor agreement is planned; this page will change before it is used. |
2. What we do not use
- No analytics or tag-management vendor: page measurements are collected first-party, only with consent, and stored in our own database.
- No advertising network or tracking pixel.
- No content delivery network: the public site and the platform are served from our own servers.
- No external AI provider for the platform’s own intelligence: selection, healing, analysis and document answers run on local models inside the platform.
- No payment processor holding card data: checkout is a bank transfer against an invoice.
3. Providers you choose yourself
The LLM testing surface forwards prompts to the provider whose API key you supply (for example OpenAI, Anthropic or a self-hosted model). That provider processes those prompts under your agreement with it, not under ours; the platform records the call, the cost and the detector findings, and never stores your key in plain text.
4. How we announce a change
Before a new sub-processor processes customer data, we add it to the table above with the date the change takes effect and send a notice to every account owner in the platform inbox. The Data Processing Addendum sets out your options if you object. Removals are recorded in the same way.
Related documents
Questions about this document go to the contact form with the topic set to legal; a reply comes from a person within one business day.