Legal
Subprocessors
Third parties that process personal data on our behalf.
Last updated October 11, 2026 · Aurumaxis Labs Limited
Current subprocessors
| Subprocessor | Purpose | Location | Data |
|---|---|---|---|
| Vercel Inc. | Application hosting, serverless compute, CDN, logs | United States (global edge) | All service data in transit; request logs |
| Supabase Inc. | Primary Postgres database | United States (us-east-1) | Account, workspace, scan, billing-status and lead data |
| Upstash Inc. | Redis for rate limiting | United States | Hashed request keys (IP or user ID) and counters, auto-expiring |
| Stripe, Inc. / Stripe Payments Europe | Payments, subscriptions, invoicing, tax | United States / Ireland | Name, email, billing address, payment method (Stripe holds card data) |
| Resend Inc. | Transactional email (sign-in links, alerts, receipts) | United States | Email address, email content |
| OpenAI, L.L.C. | ChatGPT answers for scans (with web search); category inference | United States | Prompts with product/business names, categories, websites (no account emails) |
Updates
We give at least 14 days' notice before adding or replacing a subprocessor, by email to account owners and in the Changelog. Questions or objections: [email protected].
Questions: [email protected]