Subprocessors
Who processes data on our behalf, what for, and where.
- Last updated
- 8 October 2026
- Agreement
- DPA
- Questions
- info@vallit.net
Our subprocessors
These services process personal data you put into Vallit on our behalf and on our instructions. Each has a contract with us under Art. 28(4) GDPR.
| Service | Task | Data | Seat, storage | Basis for transfer |
|---|---|---|---|---|
| Vercel Inc. | Hosting of the app, server logs, measurement in the app, routing to language models (AI Gateway) | All app data while it is processed; IP addresses and requests in logs | USA; the app runs in Frankfurt | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Supabase, Inc. | The app’s database | Accounts, workspaces, apps, reports, findings, measurements, fix requests | USA; data in Frankfurt | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Clerk, Inc. | Accounts, sign-in, sessions, protection against automated sign-ins | Names, email addresses, memberships, IP address and browser at sign-in | USA | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Resend (Plus Five Five, Inc.) | Sending reports, alerts, summaries and account emails | Email addresses and the content of the email | USA | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Anthropic PBC | Confirming findings in code excerpts from connected repositories; looking for gaps in our checks in public traits of a sample of checked apps; both through Vercel AI Gateway | Short code excerpts, public headers and script excerpts, titles of earlier findings; recognised credentials are removed first | USA | EU-US Data Privacy Framework or Standard Contractual Clauses |
| Apple Distribution International Ltd. (iCloud Mail) | Our mailbox | Emails you send us and our replies | Ireland | EU, no transfer needed |
Services that do not act on our behalf
These services receive data but act for themselves or for you, so they are not subprocessors:
- Stripe Payments Europe, Ltd. (Irland / Ireland): Payments and subscriptions; processes payment data partly as a controller of its own
- GitHub, Inc.: Your own repository provider; we access it through the Vallit GitHub App when you install it
- Cloudflare, Inc. / Ihr Domain-Anbieter: Only when you have the DNS record created through it; your own provider
- OSV, rdap.org, SSLMate CertSpotter, crt.sh: Public registries; receive only domain and package names, no personal data
Changes
We announce a new or replaced subprocessor by email to every workspace’s admins at least 14 days before it is engaged and add it here. How you can object is set out in the Data Processing Agreement. Questions to info@vallit.net.