Subprocessors
510sec · Last updated 2026-09-22
The third parties that process data on our behalf. We keep this list short on purpose, and we update it before adding a new one.
| Subprocessor | Purpose | Data it can see | Location |
|---|---|---|---|
| Amazon Web Services | Application hosting and storage; AI polish through Amazon Bedrock, when you choose it for a run; AI assist through Amazon Bedrock, when it is on and you consent for a request | All service data at rest and in transit | USA (us-east-2) |
| Square | Payment processing | Buyer email, amount, card details (entered directly with Square - never with us) | USA |
| Email delivery provider | Verification codes and receipts | Recipient address and message content | USA |
| Google (only if you sign in with Google) | Identity verification | Your email address and name from your Google profile | USA |
AI providers
Document generation uses no AI provider. The optional prose-polish feature runs on OpenAI and Anthropic models hosted in Amazon Bedrock, part of AWS above. Only threat-description text is sent, never your full specification or source code. Amazon Bedrock does not pass it to the model makers, so neither OpenAI nor Anthropic is a subprocessor for it.
AI assist
AI assist is off unless the operator and your organization's owner turn it on. It runs on OpenAI and Anthropic models hosted in Amazon Bedrock, inside our AWS account, in US Regions. Amazon Bedrock does not pass your content to the model makers, so neither OpenAI nor Anthropic receives anything. Nothing is sent until you tick consent for that one request. Then only that request's section is sent. That is the harm being checked, one answer's evidence, one paragraph, or the document you supplied for that suggestion. For the cross-step check it is a summary of your device description. For a draft answer it is that run's review report; for an applicability note, the advisory and the affected component's description; for a change summary, the comparison of the two runs. We send each request with response storage turned off; AWS may keep request data within AWS for abuse detection. Uploaded documents are not stored.
Optional vulnerability lookup
Off unless you run it from a run page. When you do, the package URLs of your declared
dependencies - ecosystem, name and version, for example pkg:pypi/django@4.2.7 - are
sent to OSV.dev, the open vulnerability database operated by Google, and advisory details
are then fetched by advisory id. Nothing else about the device is sent. The page shows the exact
list before sending, and your consent is recorded with the run.
Optional support-status lookup
Off unless you run it from a run page. When you do, the names of your declared operating systems, runtimes and frameworks are sent to endoflife.date, a public end-of-life reference. The package names of your declared libraries go to their public registry: PyPI, npm, Maven Central, crates.io or NuGet. Versions are matched on our side and are not sent. Nothing else about the device is sent. The page shows the exact requests before sending, and your consent is recorded with the run.
Changes
We will update this page before a new subprocessor begins handling customer data. If you need advance written notice of changes, ask us for it in your agreement.