5 Verified Infrastructure Vendors

Everyone who touches customer data.

We share the absolute minimum. Every vendor below is contractually bound through Data Processing Agreements (DPAs) to process telemetry only on our instructions.

Last updated October 2026 · 30 days written notice before material changes

Vendor	Purpose	Data Handled	Region	Safeguards
Vercel	Web hosting and global edge delivery	Encrypted web application traffic, session tokens	Global / US East	SOC 2 Type II, ISO 27001
Neon	Serverless PostgreSQL database infrastructure	Account metadata, organization findings, user profiles	AWS ap-south-1 (Mumbai) / eu-central-1 (Frankfurt)	SOC 2 Type II, ISO 27001, AES-256 at rest
Cloudflare R2	Encrypted file and pentest report object storage	Encrypted PDF reports, proof-of-concept artefacts	APAC / Global Edge	SOC 2 Type II, ISO 27001, private signed URLs
Hetzner	Dedicated API services and isolated scanner workers	Ephemeral scan payload execution, worker containers	Falkenstein, Germany / Helsinki, Finland	ISO 27001 certified data centers, ephemeral disks
Razorpay	Payment processing and GST-compliant invoicing	Billing contacts, transaction identifiers (no card data stored)	India	PCI DSS Level 1, ISO 27001

Commitment: We will notify customers in writing at least 30 days prior to any material change or addition of a new subprocessor. Customers have the right to object within this 30-day window.

How We Vet Subprocessors

1.Minimum viable set — vendors are added only when safe self-hosting is unviable.
2.Rigorous security reviews: SOC 2 Type II or ISO 27001 certificates required.
3.Contractual bans on model training, cross-tenant telemetry, or third-party resale.

Objection or Residency Questions

If a vendor on this list conflicts with your company’s internal compliance policy or data sovereignty rules, contact our security officer. We offer dedicated India data residency or custom configurations.

Contact Security Officer Back to Trust Centre