TRANSPARENCY · SUBPROCESSORS
Subprocessors
Who touches your data, in what role, and under whose terms.
| PROVIDER | WHAT THEY RECEIVE | LOCATION | TRAINING COMMITMENT |
|---|---|---|---|
| Google Cloud / Firebase | The code payload at rest, and your report. Infrastructure only: it stores and runs, it performs no analysis | US | n/a (infrastructure) · the payload is sent to model providers by our functions, never by the storage layer |
| Stripe | Payment details. Never your code | US | n/a (never sees your code) |
| Google (Gemini API) | The code payload, for automated analysis | US | No training on inputs (paid API tier) |
| OpenAI (API) | The code payload, for automated analysis | US company · we have not contracted for a specific processing region | No training on inputs (business API terms) |
| Anthropic (API) | The engines' reports only. Never the code payload | US company · we have not contracted for a specific processing region | No training on inputs (commercial terms) |
| Mistral (served via Amazon Bedrock, AWS) | The code payload, for automated analysis | US (model origin: France · served on US AWS infrastructure) | No training on inputs (AWS Bedrock terms) |
| Fireworks AI | Engaged only when a primary engine or the judge fails: the code payload when it substitutes for an engine, the engines' reports when it substitutes for the judge · serves non-US-origin models | Model origin: China · served by Fireworks on its standard serverless endpoints; we have not contracted for a specific processing region | No training on inputs (business API terms) |
| Resend | Transactional email (audit token delivery, report links) · receives the recipient address, the repository URL, the score, the tier, and up to 300 characters of the judge's written verdict · never the code payload and never a finding's cited evidence | US | n/a (receives no code payload) |
This list updates before any provider is added or replaced.
Training and retention entries describe each provider's own published terms, not undertakings by us. Last read against those terms on 30 July 2026.
Questions: see the Privacy Policy.